by Kastro
Paper/Archive/CVE-2023-5841

CVE-2023-5841

Academy Software Foundation OpenEXR — OpenEXR Heap Overflow in Scanline Deep Data Parsing

EPSS 1%public exploitCVSS 9.1
critical.is priorityof 100
51
CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 69.4.694 × 2013.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Affected

ProductAffectedFixed inSource
OpenEXR≤ 3.2.13.2.2CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

reftakeonme.org/cves/CVE-2023-5841.htmlreflists.fedoraproject.org/archives/list/[email protected]/message/LSB6DB5LAKGPLRXEF5HDNGUMT7GIFT2Creflists.fedoraproject.org/archives/list/[email protected]/message/XWMINVKQLSUHECXBSQMZFCSDRIHFOJJIrefseclists.org/fulldisclosure/2024/Sep/36refseclists.org/fulldisclosure/2024/Sep/34refseclists.org/fulldisclosure/2024/Sep/32