Bug 513995 – CVE-2009-1720 OpenEXR: Multiple integer overflows

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 513995 - (CVE-2009-1720) CVE-2009-1720 OpenEXR: Multiple integer overflows

Summary:	CVE-2009-1720 OpenEXR: Multiple integer overflows

Status:	CLOSED ERRATA

Aliases:	CVE-2009-1720

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,reported=20090708,pu...
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2009-07-27 11:06 EDT by Jan Lieskovsky
Modified:	2016-03-04 07:21 EST (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2009-08-03 02:25:00 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Integer overflow in Imf::PreviewImage::PreviewImage (CVE-2009-1720, issue#1) patch by Drew Yao (497 bytes, patch) 2009-07-28 10:16 EDT, Jan Lieskovsky	no flags	Details \| Diff
Integer overflows in compressor constructors (CVE-2009-1720, issue#2) patch by Drew Yao (1.87 KB, patch) 2009-07-28 10:19 EDT, Jan Lieskovsky	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Jan Lieskovsky 2009-07-27 11:06:14 EDT

Multiple integer overflow flaws, leading to heap-based buffer overflows
were found in OpenEXR. A remote attacker could provide a specially-crafted
image file, which once opened by a local, unsuspecting user, would lead
to denial of service ("exrmakepreview" crash), or potentially, arbitrary
code execution with the privileges of the user opening the image.

Credit:  Drew Yao of Apple Product Security 
------

Comment 6 Jan Lieskovsky 2009-07-28 09:31:24 EDT

Public now via:

  http://seclists.org/fulldisclosure/2009/Jul/0444.html

Comment 7 Jan Lieskovsky 2009-07-28 09:51:26 EDT

This issue affects the versions of the OpenEXR package, as shipped
with Fedora releases of 10 and 11.

This issue affects the versions of the OpenEXR package, as shipped
with Extra Packages for Enterprise Linux 4 (EPEL4) and Extra
Packages for Enterprise Linux 5 (EPEL5) projects.

Comment 8 Jan Lieskovsky 2009-07-28 10:16:09 EDT

Created attachment 355417 [details]
Integer overflow in Imf::PreviewImage::PreviewImage
(CVE-2009-1720, issue#1) patch by Drew Yao

Comment 9 Jan Lieskovsky 2009-07-28 10:19:04 EDT

Created attachment 355418 [details]
Integer overflows in compressor constructors (CVE-2009-1720, issue#2) patch by Drew Yao

Comment 10 Fedora Update System 2009-07-29 14:56:26 EDT

OpenEXR-1.6.1-8.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/OpenEXR-1.6.1-8.fc10

Comment 11 Fedora Update System 2009-07-29 14:56:45 EDT

OpenEXR-1.6.1-8.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/OpenEXR-1.6.1-8.fc11

Comment 12 Fedora Update System 2009-07-30 15:35:37 EDT

OpenEXR-1.4.0a-5.el5 has been submitted as an update for Fedora EPEL 5.
http://admin.fedoraproject.org/updates/OpenEXR-1.4.0a-5.el5

Comment 13 Fedora Update System 2009-07-30 15:37:16 EDT

OpenEXR-1.4.0a-5.el4 has been submitted as an update for Fedora EPEL 4.
http://admin.fedoraproject.org/updates/OpenEXR-1.4.0a-5.el4

Comment 14 Fedora Update System 2009-07-31 14:01:11 EDT

OpenEXR-1.6.1-8.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Fedora Update System 2009-07-31 14:01:56 EDT

OpenEXR-1.6.1-8.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 16 Fedora Update System 2009-07-31 17:27:47 EDT

OpenEXR-1.4.0a-5.el4 has been pushed to the Fedora EPEL 4 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 17 Fedora Update System 2009-07-31 17:28:16 EDT

OpenEXR-1.4.0a-5.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.