CVE-2021-20299 — Vulnetix

Try Vulnetix Request Demo

CVE-2021-20299 PUBLISHED

A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.

EPSS 1.03% · 77.2th percentile

Risk Scores

EPSS Score

1.03%

77.2th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:Pro:16.04:LTS	openexr	0, 2.2.0-7ubuntu1, 2.2.0-10ubuntu2
Ubuntu:Pro:20.04:LTS	openexr	2.3.0-6ubuntu0.2, 0, 2.2.1-4.1ubuntu1
Ubuntu:18.04:LTS	openexr	2.2.0-11.1ubuntu1.9, 2.2.0-11.1ubuntu1.2, 0

Timeline

Aug 20, 2021 CVE Published
Mar 16, 2022 PoC Published
Mar 17, 2022 EPSS Score
May 7, 2022 EPSS Score
Jun 26, 2022 EPSS Score
Aug 17, 2022 EPSS Score
Nov 26, 2022 EPSS Score
Dec 13, 2022 CVE Updated
Dec 28, 2022 EPSS Score
Jan 16, 2023 EPSS Score
Feb 23, 2023 EPSS Score
Mar 7, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2021-20299 third-party-advisory
https://github.com/AcademySoftwareFoundation/openexr/pull/840 third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2021-20299 third-party-advisory

Open in Interactive Console →