Bug 1947612 (CVE-2021-23169)

Summary:	CVE-2021-23169 OpenEXR: Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jeischma, jridky, manisandro, rdieter, rh-spice-bugs
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	OpenEXR 3.0.1	Doc Type:	If docs needed, set a value
Doc Text:	A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1947613, 1952477, 1952478, 1952479, 1952480, 1952481
Bug Blocks:	1947625, 1966941

Description Pedro Sampaio 2021-04-08 18:10:28 UTC

Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer

References:

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28051

Comment 1 Pedro Sampaio 2021-04-08 18:10:52 UTC

Created OpenEXR tracking bugs for this issue:

Affects: fedora-all [bug 1947613]

Comment 2 Huzaifa S. Sidhpurwala 2021-04-22 11:01:20 UTC

Upstream PR: https://github.com/AcademySoftwareFoundation/openexr/pull/872
Upstream commit: https://github.com/AcademySoftwareFoundation/openexr/commit/ae6d203892cc9311917a7f4f05354ef792b3e58e