CVE-2021-20299

Published: 16 March 2022

A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.

Priority

CVSS 3 base score: 7.5

Status

Package	Release	Status
openexr Launchpad, Ubuntu, Debian	bionic	Needed
	focal	Needs triage
	groovy	Ignored (reached end-of-life)
	hirsute	Not vulnerable (2.5.4-1)
	impish	Not vulnerable (2.5.4-2)
	jammy	Not vulnerable (2.5.7-1)
	trusty	Does not exist
	upstream	Released (2.5.4-1)
	xenial	Needs triage

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20299
https://github.com/AcademySoftwareFoundation/openexr/pull/840
NVD
Launchpad
Debian

Bugs

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25740

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›