kritik
CVE-2025-48072
openexr: OpenEXR Out of Bounds Read
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GHSA6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Red Hat5.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (orta), Red Hat (orta), Ubuntu (orta).
Açıklama
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR files with a maliciously forged chunk. This is fixed in version 3.3.3.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.2-r0 |
| alpine 3.24 | openexr | 3.4.2-r0 |
| alpine edge | openexr | 3.4.2-r0 |
| pip::GitHub Security Advisory pip | openexr | 3.3.3 |
| rapidfort alpine 3.20 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.21 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.22 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.23 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.24 | openexr | 3.3.11-r0 |
| rapidfort ubuntu 20.04 | openexr, rf-openexr | düzeltme belirtilmemiş |
| rapidfort ubuntu 22.04 | openexr, rf-openexr | düzeltme belirtilmemiş |
15 kaynaktaki 18 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.22 | openexr | 3.3.11-r0 |
| alpine 3.23 | openexr | 3.4.2-r0 |
| alpine 3.24 | openexr | 3.4.2-r0 |
| alpine edge | openexr | 3.4.2-r0 |
| pip::GitHub Security Advisory pip | openexr | 3.3.3 |
| rapidfort alpine 3.20 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.21 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.22 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.23 | openexr | 3.3.11-r0 |
| rapidfort alpine 3.24 | openexr | 3.3.11-r0 |
| rapidfort ubuntu 20.04 | openexr | düzeltme belirtilmemiş |
| rapidfort ubuntu 20.04 | rf-openexr | düzeltme belirtilmemiş |
| rapidfort ubuntu 22.04 | openexr | düzeltme belirtilmemiş |
| rapidfort ubuntu 22.04 | rf-openexr | düzeltme belirtilmemiş |
| rapidfort ubuntu 24.04 | openexr | düzeltme belirtilmemiş |
| rapidfort ubuntu 24.04 | rf-openexr | düzeltme belirtilmemiş |
| ubuntu 26.04 | openexr | düzeltme belirtilmemiş |
| ubuntu 26.10 | openexr | düzeltme belirtilmemiş |
Referanslar
- https://access.redhat.com/security/cve/CVE-2025-48072
- https://github.com/AcademySoftwareFoundation/openexr
- https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361
- https://github.com/AcademySoftwareFoundation/openexr/commit/2d09449427b13a05f7c31a98ab2c4347c23db361%20%28v3.3.3-rc%29
- https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.3
- https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-4r7w-q3jg-ff43
- https://github.com/ShielderSec/poc/tree/main/CVE-2025-48072
- https://nvd.nist.gov/vuln/detail/CVE-2025-48072