CVE-2021-45942 Memory corruption in n/a

Medium 5.5 Published 31 Dec 2021 Updated 4 Aug 2024

A heap-based buffer overflow in OpenEXR allows attackers to execute arbitrary code or cause denial of service via crafted image files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-45942?

CVE-2021-45942 is a medium-severity memory corruption vulnerability in Debian Debian Linux, published on 31 Dec 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in Imf_3_1::LineCompositeTask::execute (called from IlmThread_3_1::NullThreadPoolProvider::addTask and IlmThread_3_1::ThreadPool::addGlobalTask). NOTE: db217f2 may be inapplicable.

Weakness: CWE-787

Which versions are affected by CVE-2021-45942?

It affects 3 products.

Linux distribution packages (9)

`openexr` SUSE:Linux Enterprise Module for Desktop Applications 15 SP3	All versions	`2.2.1-3.41.1`
`openexr` SUSE:Linux Enterprise Real Time 15 SP2	All versions	`2.2.1-3.41.1`
`openexr` SUSE:Linux Enterprise Server 12 SP5	All versions	`2.1.0-6.45.1`
`openexr` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`2.1.0-6.45.1`
`openexr` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`2.1.0-6.45.1`
`openexr` SUSE:Linux Enterprise Workstation Extension 12 SP5	All versions	`2.1.0-6.45.1`
`cobbler` SUSE:Package Hub 15 SP3	All versions	`3.1.2-bp153.2.3.1`
`cobbler` openSUSE:Leap 15.3	All versions	`3.1.2-bp153.2.3.1`
`openexr` openSUSE:Leap 15.3	All versions	`2.2.1-3.41.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Openexr Openexr.

How do I fix CVE-2021-45942?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-45942 being exploited?

There is no known exploitation of CVE-2021-45942 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-45942, GHSA-68rw-m3hm-pqp8, JLSEC-2026-132, MGASA-2022-0020, OESA-2022-1639, SUSE-SU-2022:0061-1 and 5 more.