critique
CVE-2025-48072
openexr: OpenEXR Out of Bounds Read
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Red Hat5.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon GHSA (moyenne), Red Hat (moyenne), Ubuntu (moyenne).
Description
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.2-r0 |
| alpine 3.24 | openexr | 3.4.2-r0 |
| alpine edge | openexr | 3.4.2-r0 |
| pip::GitHub Security Advisory pip | openexr | 3.3.3 |
| rapidfort alpine 3.20 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.21 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.22 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.23 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.24 | openexr | 3.3.11-r0 |
| rapidfort ubuntu 20.04 | openexr, rf-openexr | pas de correctif indiqué |
| rapidfort ubuntu 22.04 | openexr, rf-openexr | pas de correctif indiqué |
Afficher les 18 entrées de 15 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.2-r0 |
| alpine 3.24 | openexr | 3.4.2-r0 |
| alpine edge | openexr | 3.4.2-r0 |
| pip::GitHub Security Advisory pip | openexr | 3.3.3 |
| rapidfort alpine 3.20 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.21 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.22 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.23 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.24 | openexr | 3.3.11-r0 |
| rapidfort ubuntu 20.04 | openexr | pas de correctif indiqué |
| rapidfort ubuntu 20.04 | rf-openexr | pas de correctif indiqué |
| rapidfort ubuntu 22.04 | openexr | pas de correctif indiqué |
| rapidfort ubuntu 22.04 | rf-openexr | pas de correctif indiqué |
| rapidfort ubuntu 24.04 | openexr | pas de correctif indiqué |
| rapidfort ubuntu 24.04 | rf-openexr | pas de correctif indiqué |
| ubuntu 26.04 | openexr | pas de correctif indiqué |
| ubuntu 26.10 | openexr | pas de correctif indiqué |
Références
- https://access.redhat.com/security/cve/CVE-2025-48072
- https://github.com/AcademySoftwareFoundation/openexr
- https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361
- https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361%20%28v3.3.3-rc%29
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43
- https://github.com/ShielderSec/poc/tree/main/CVE-2025-48072
- https://nvd.nist.gov/vuln/detail/CVE-2025-48072