CVE-2009-1722

Published: Jul 31, 2009Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Heap-based buffer overflow in the compression implementation in OpenEXR 1.2.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.

Affected (1)

Products: Openexr: Openexr

Openexr

1 product

Openexr

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openexr Openexr	Version 1.2.2

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (30)

http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html

Source: cve@mitre.org

http://secunia.com/advisories/36032

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/36096

Source: cve@mitre.org

http://secunia.com/advisories/36753

Source: cve@mitre.org

http://security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz

Source: cve@mitre.org

Patch

http://support.apple.com/kb/HT3757

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1842

Source: cve@mitre.org

Patch

http://www.mandriva.com/security/advisories?name=MDVSA-2009:191

Source: cve@mitre.org

http://www.securityfocus.com/bid/35838

Source: cve@mitre.org

Patch

http://www.securitytracker.com/id?1022674

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-831-1

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA09-218A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2009/2035

Source: cve@mitre.org

Vendor Advisory

http://www.vupen.com/english/advisories/2009/2172

Source: cve@mitre.org

https://github.com/openexr/openexr/blob/master/CHANGES.md#version-170-july-23-2010

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html