Ubuntu 20.04 LTS: USN-4339-1 Critical: OpenEXR Denial Of Service

ubuntu

April 27, 2020

Several security issues were fixed in OpenEXR.

Summary

Several security issues were fixed in OpenEXR.

Software Description:

- openexr: tools for the OpenEXR image format

Details:

Brandon Perry discovered that OpenEXR incorrectly handled certain malformed

EXR image files. If a user were tricked into opening a crafted EXR image

file, a remote attacker could cause a denial of service, or possibly

execute arbitrary code. This issue only applied to Ubuntu 20.04 LTS.

(CVE-2017-9111, CVE-2017-9113, CVE-2017-9115)

Tan Jie discovered that OpenEXR incorrectly handled certain malformed EXR

image files. If a user were tricked into opening a crafted EXR image file,

a remote attacker could cause a denial of service, or possibly execute

arbitrary code. This issue only applied to Ubuntu 20.04 LTS.

(CVE-2018-18444)

Samuel Groß discovered that OpenEXR incorrectly handled certain malformed

EXR image files. If a user were tricked into opening a crafted EXR image

file, a remote attacker could cause a denial of service, or possib...

Read the Full Advisory

Topics Covered

security advisory denial of service Ubuntu update instructions image format openexr

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04:
  libopenexr24                    2.3.0-6ubuntu0.1
  openexr                         2.3.0-6ubuntu0.1

Ubuntu 19.10:
  libopenexr23                    2.2.1-4.1ubuntu1.1
  openexr                         2.2.1-4.1ubuntu1.1

Ubuntu 18.04 LTS:
  libopenexr22                    2.2.0-11.1ubuntu1.2
  openexr                         2.2.0-11.1ubuntu1.2

Ubuntu 16.04 LTS:
  libopenexr22                    2.2.0-10ubuntu2.2
  openexr                         2.2.0-10ubuntu2.2

In general, a standard system update will make all the necessary changes.