This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-3933 →

DEBIAN-CVE-2021-3933

An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and...

Original description

The description as published by the source.

An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 openexr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-2"}]}]

Debian:13 openexr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-2"}]}]

Debian:14 openexr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-2"}]}]

References

advisory security-tracker.debian.org