CVE-2020-15306

Published: Jun 26, 2020Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp.

Affected (11)

Products: Openexr: Openexr · Fedoraproject: Fedora · Opensuse: Leap · +2 more

Show all products

Openexr: Openexr · Fedoraproject: Fedora · Opensuse: Leap · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openexr Openexr	Before 2.5.2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration E

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.10
Canonical Ubuntu Linux	Version 20.04

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (24)

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00025.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00048.html

Source: cve@mitre.org

Third Party Advisory

https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/AcademySoftwareFoundation/openexr/blob/master/SECURITY.md

Source: cve@mitre.org

Third Party Advisory

https://github.com/AcademySoftwareFoundation/openexr/pull/738

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2

Source: cve@mitre.org

Release NotesThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html

Source: cve@mitre.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKDRVXORM2VLNHRLFKS3JHRABSHZ5W5M/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SHYAKRAUEMYVCV7U5WLDRE2YFGSV5PIT/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202107-27

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/4418-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2020/dsa-4755

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00025.html