This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-3941 →

DEBIAN-CVE-2021-3941

In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma....

Original description

The description as published by the source.

In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y; and chroma.green.y * (X + Z))) / d; but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition which could affect the availability of programs linked with OpenEXR.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 openexr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-2"}]}]

Debian:13 openexr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-2"}]}]

Debian:14 openexr

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-2"}]}]

References

advisory security-tracker.debian.org