CVE-2017-9111

Published: 21 May 2017

In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.

Priority

CVSS 3 base score: 8.8

Status

Package	Release	Status
openexr Launchpad, Ubuntu, Debian	Upstream	Needs triage

	Ubuntu 20.10 (Groovy Gorilla)	Released (2.3.0-6ubuntu0.1)
	Ubuntu 20.04 LTS (Focal Fossa)	Released (2.3.0-6ubuntu0.1)
	Ubuntu 18.04 LTS (Bionic Beaver)	Released (2.2.0-11.1ubuntu1.1)
	Ubuntu 16.04 LTS (Xenial Xerus)	Released (2.2.0-10ubuntu2.1)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was deferred [2019-05-27])
	Ubuntu 12.04 ESM (Precise Pangolin)	Does not exist
	Patches: Upstream: https://github.com/openexr/openexr/commit/4aa6a4e0fcd52b220c71807307b9139966c3644c (2.4) Upstream: https://github.com/openexr/openexr/commit/6a41400b47d574a5fc6133b9a7139bcd7b59d585 (2.4) Upstream: https://github.com/openexr/openexr/commit/119eb2d4672e5c77a79929758f7e4c566f47c794 (2.4) Upstream: https://github.com/openexr/openexr/commit/45f9912e6cfa0617ec2054d96d1e1e73fad4a62a (2.3) Upstream: https://github.com/openexr/openexr/commit/a7eec54765e9122b78a6c34bb9d5bf744631bea2 (2.3) Upstream: https://github.com/openexr/openexr/commit/ec64836c2312b13034149acab499c112bd289cd9 (2.3)

Notes

Author	Note
mdeslaur	see suse bug for reproducer with exrmakepreview first patch in upstream bug doesn't cover this CVE The patch for this issue was dropped during the focal development cycle by mistake.

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM

Further reading