CVE-2021-3933 Integer overflow in openexr
An integer overflow in OpenEXR on 32-bit systems can cause instability or enable further attacks when processing crafted files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-3933?
CVE-2021-3933 is a medium-severity vulnerability in Debian Debian Linux, published on 25 Mar 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.
Weakness: CWE-190
Which versions are affected by CVE-2021-3933?
It affects 3 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Openexr Openexr.
How do I fix CVE-2021-3933?
Apply the vendor's patch.
Is CVE-2021-3933 being exploited?
There is no known exploitation of CVE-2021-3933 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2021-3933, GHSA-jmmx-24xf-r6qm, JLSEC-2026-130, UBUNTU-CVE-2021-3933, USN-5144-1.