CVE-2020-11763

Published: Apr 14, 2020Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp.

Affected (42)

Products: Openexr: Openexr · Fedoraproject: Fedora · Canonical: Ubuntu Linux · +3 more

Show all products

Openexr: Openexr · Fedoraproject: Fedora · Canonical: Ubuntu Linux · Opensuse: Leap · Debian: Debian Linux · Apple: Icloud, Ipados, Iphone Os, Itunes, Mac Os X, Tvos, Watchos

1 product

1 product

1 product

1 product

1 product

7 products

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openexr Openexr	version < 2.4.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.10
Canonical Ubuntu Linux	Version 20.04

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration F

33 vulnerable

Vulnerable Software	Affected Versions
Apple Icloud	version < 7.20
Apple Icloud	10.0 ≤ version < 11.3
Apple Ipados	version < 13.6
Apple Iphone Os	version < 13.6
Apple Itunes	version < 12.10.8
Apple Mac Os X	10.13.0 ≤ version < 10.13.6
Apple Mac Os X	10.14.0 ≤ version < 10.14.6
Apple Mac Os X	10.15 ≤ version < 10.15.6
Apple Mac Os X	Version 10.13.6
Apple Mac Os X	Version 10.13.6 security_update_2018-002
Apple Mac Os X	Version 10.13.6 security_update_2018-003
Apple Mac Os X	Version 10.13.6 security_update_2019-001
Apple Mac Os X	Version 10.13.6 security_update_2019-002
Apple Mac Os X	Version 10.13.6 security_update_2019-003
Apple Mac Os X	Version 10.13.6 security_update_2019-004
Apple Mac Os X	Version 10.13.6 security_update_2019-005
Apple Mac Os X	Version 10.13.6 security_update_2019-006
Apple Mac Os X	Version 10.13.6 security_update_2019-007
Apple Mac Os X	Version 10.13.6 security_update_2020-001
Apple Mac Os X	Version 10.13.6 security_update_2020-002
Apple Mac Os X	Version 10.13.6 security_update_2020-003
Apple Mac Os X	Version 10.14.6
Apple Mac Os X	Version 10.14.6 security_update_2019-001
Apple Mac Os X	Version 10.14.6 security_update_2019-002
Apple Mac Os X	Version 10.14.6 security_update_2019-004
Apple Mac Os X	Version 10.14.6 security_update_2019-005
Apple Mac Os X	Version 10.14.6 security_update_2019-006
Apple Mac Os X	Version 10.14.6 security_update_2019-007
Apple Mac Os X	Version 10.14.6 security_update_2020-001
Apple Mac Os X	Version 10.14.6 security_update_2020-002
Apple Mac Os X	Version 10.14.6 security_update_2020-003
Apple Tvos	version < 13.4.8
Apple Watchos	version < 6.2.8

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (32)

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://bugs.chromium.org/p/project-zero/issues/detail?id=1987

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1

Source: cve@mitre.org

Release NotesThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4KFGDQG5PVYAU7TS5MZ7XCS6EMPVII3/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202107-27

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211288

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211289

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211290

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211291

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211293

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211294

Source: cve@mitre.org

Third Party Advisory

https://support.apple.com/kb/HT211295

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4339-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2020/dsa-4755

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00051.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://bugs.chromium.org/p/project-zero/issues/detail?id=1987

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md#version-241-february-11-2020

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.4.1

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F4KFGDQG5PVYAU7TS5MZ7XCS6EMPVII3/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202107-27

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT211288

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT211289

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT211290

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT211291

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT211293

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT211294

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.apple.com/kb/HT211295

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/4339-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4755

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.