CVE-2009-1721

Published: Jul 31, 2009Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.

Affected (13)

Products: Openexr: Openexr · Opensuse: Opensuse · Apple: Mac Os X · +3 more

Show all products

Openexr: Openexr · Opensuse: Opensuse · Apple: Mac Os X · Debian: Debian Linux · Canonical: Ubuntu Linux · Fedoraproject: Fedora

1 product

1 product

1 product

1 product

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Openexr Openexr	Version 1.2.2
Openexr Openexr	Version 1.6.1

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 10.0
Opensuse Opensuse	Version 10.3
Opensuse Opensuse	Version 11.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Before 10.5.8

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 5.0

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10
Canonical Ubuntu Linux	Version 9.04

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 10
Fedoraproject Fedora	Version 11

Related CWEs

CWE-824

Access of Uninitialized Pointer

The product accesses or uses a pointer that has not been initialized.

References (44)

http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html

Source: cve@mitre.org

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00000.html

Source: cve@mitre.org

Mailing List

http://release.debian.org/proposed-updates/stable_diffs/openexr_1.6.1-3%2Blenny3.debdiff

Source: cve@mitre.org

Broken LinkPatch

http://secunia.com/advisories/36030

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/36032

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/36096

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/36123

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/36753

Source: cve@mitre.org

Broken Link

http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz

Source: cve@mitre.org

Broken LinkPatch

http://security.debian.org/pool/updates/main/o/openexr/openexr_1.6.1-3+lenny3.diff.gz

Source: cve@mitre.org

Broken LinkPatch

http://support.apple.com/kb/HT3757

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2009/dsa-1842

Source: cve@mitre.org

Mailing List

http://www.mandriva.com/security/advisories?name=MDVSA-2009:190

Source: cve@mitre.org

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2009:191

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/bid/35838

Source: cve@mitre.org

Broken LinkPatchThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1022674

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-831-1

Source: cve@mitre.org

Third Party Advisory

http://www.us-cert.gov/cas/techalerts/TA09-218A.html

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://www.vupen.com/english/advisories/2009/2035

Source: cve@mitre.org

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2009/2172

Source: cve@mitre.org

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01286.html

Source: cve@mitre.org

Mailing List

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg01290.html

Source: cve@mitre.org

Mailing List

http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html