Test ID:	1.3.6.1.4.1.25623.1.1.10.2020.0189
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2020-0189)
Summary:	The remote host is missing an update for the 'openexr' package(s) announced via the MGASA-2020-0189 advisory.
Description:	Summary: The remote host is missing an update for the 'openexr' package(s) announced via the MGASA-2020-0189 advisory. Vulnerability Insight: The updated packages fix security vulnerabilities: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h. (CVE-2020-11758) An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock, an attacker can write to an out-of-bounds pointer. (CVE-2020-11759) An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp. (CVE-2020-11760) An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. (CVE-2020-11761) An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case. (CVE-2020-11762) An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp. (CVE-2020-11763) An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp. (CVE-2020-11764) An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Classifier, leading to an out-of-bounds read. (CVE-2020-11765) Affected Software/OS: 'openexr' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-11758 Debian Security Information: DSA-4755 (Google Search) https://www.debian.org/security/2020/dsa-4755 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F4KFGDQG5PVYAU7TS5MZ7XCS6EMPVII3/ https://security.gentoo.org/glsa/202107-27 https://bugs.chromium.org/p/project-zero/issues/detail?id=1987 https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020 https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1 https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html SuSE Security Announcement: openSUSE-SU-2020:0682 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html https://usn.ubuntu.com/4339-1/ Common Vulnerability Exposure (CVE) ID: CVE-2020-11759 Common Vulnerability Exposure (CVE) ID: CVE-2020-11760 Common Vulnerability Exposure (CVE) ID: CVE-2020-11761 Common Vulnerability Exposure (CVE) ID: CVE-2020-11762 Common Vulnerability Exposure (CVE) ID: CVE-2020-11763 Common Vulnerability Exposure (CVE) ID: CVE-2020-11764 Common Vulnerability Exposure (CVE) ID: CVE-2020-11765
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.