A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openexr | Openexr | 2.3.0 (including) | 2.3.0 (including) |
| Openexr | Ubuntu | bionic | * |
| Openexr | Ubuntu | esm-apps/focal | * |
| Openexr | Ubuntu | esm-infra/bionic | * |
| Openexr | Ubuntu | esm-infra/xenial | * |
| Openexr | Ubuntu | focal | * |
| Openexr | Ubuntu | trusty | * |
| Openexr | Ubuntu | upstream | * |
| Openexr | Ubuntu | xenial | * |
Potential Mitigations
References
- https://github.com/AcademySoftwareFoundation/openexr/commit/74504503cff86e986bac441213c403b0ba28d58f
- https://github.com/AcademySoftwareFoundation/openexr/issues/493
- https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html
- https://github.com/AcademySoftwareFoundation/openexr/commit/74504503cff86e986bac441213c403b0ba28d58f
- https://github.com/AcademySoftwareFoundation/openexr/issues/493
- https://lists.debian.org/debian-lts-announce/2022/12/msg00022.html