This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-23169 →

DEBIAN-CVE-2021-23169

A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute a...

Original description

The description as published by the source.

A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 openexr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2"}]}]

Debian:13 openexr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2"}]}]

Debian:14 openexr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.4-2"}]}]

References

advisory security-tracker.debian.org