CVE-2020-11759 Integer overflow in n/a

Medium 5.5 Published 14 Apr 2020 Updated 4 Aug 2024

Integer overflows in OpenEXR allow attackers to write out-of-bounds, potentially leading to arbitrary code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-11759?

CVE-2020-11759 is a medium-severity vulnerability in Apple Icloud, published on 14 Apr 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock, an attacker can write to an out-of-bounds pointer.

Weakness: CWE-190

Which versions are affected by CVE-2020-11759?

It affects 11 products.

Products include Apple Icloud, Apple Ipados, Apple Iphone Os, Apple Itunes, Apple Mac Os X, Apple Tvos and 5 more.

How do I fix CVE-2020-11759?

Upgrade to a fixed version.

Is CVE-2020-11759 being exploited?

There is no known exploitation of CVE-2020-11759 in the wild and no public exploit code.

All Apple Icloud vulnerabilities

Sources

Also known as AZL-44139, DEBIAN-CVE-2020-11759, GHSA-fgpm-pph8-mf9r, UBUNTU-CVE-2020-11759.