Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2023-5841

critical

CVE-2023-5841

OpenEXR: Heap Overflow in Scanline Deep Data Parsing

Published Modified CWE 122, 787
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Julia9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Trivy's own label is CRITICAL. Rated critical by NVD, Julia. Rated lower by Red Hat (high), AlmaLinux (high), Oracle (high), Rocky Linux (high), Amazon (medium), Ubuntu (medium).

Description

Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the affected library.

Affected packages and fixed versions

SourcePackageFixed in
julia::Julia Ecosystem Security AdvisoriesOpenEXR_jll3.2.4+0
alma 9openexr, openexr-devel, openexr-libs3.1.1-2.el9_5.1
alpine 3.19openexr3.1.12-r0
alpine 3.20openexr3.1.12-r0
alpine 3.21openexr3.1.12-r0
alpine 3.22openexr3.1.12-r0
alpine 3.23openexr3.1.12-r0
alpine 3.24openexr3.1.12-r0
alpine edgeopenexr3.1.12-r0
amazon linux 2023openexr, openexr-debuginfo, openexr-debugsource and 3 more3.1.5-1.amzn2023.0.4
conan::GitLab Advisory Database Communityopenexrno fix listed
debian 12openexrno fix listed
Show all 52 entries from 28 sources
SourcePackageFixed in
julia::Julia Ecosystem Security AdvisoriesOpenEXR_jll3.2.4+0
alma 9openexr3.1.1-2.el9_5.1
alma 9openexr-devel3.1.1-2.el9_5.1
alma 9openexr-libs3.1.1-2.el9_5.1
alpine 3.19openexr3.1.12-r0
alpine 3.20openexr3.1.12-r0
alpine 3.21openexr3.1.12-r0
alpine 3.22openexr3.1.12-r0
alpine 3.23openexr3.1.12-r0
alpine 3.24openexr3.1.12-r0
alpine edgeopenexr3.1.12-r0
amazon linux 2023openexr3.1.5-1.amzn2023.0.4
amazon linux 2023openexr-debuginfo3.1.5-1.amzn2023.0.4
amazon linux 2023openexr-debugsource3.1.5-1.amzn2023.0.4
amazon linux 2023openexr-devel3.1.5-1.amzn2023.0.4
amazon linux 2023openexr-libs3.1.5-1.amzn2023.0.4
amazon linux 2023openexr-libs-debuginfo3.1.5-1.amzn2023.0.4
conan::GitLab Advisory Database Communityopenexrno fix listed
debian 12openexrno fix listed
debian 13openexr3.1.13-1
debian 14openexr3.1.13-1
echoopenexr3.1.13-1
Oracle Linux 9openexr3.1.1-2.el9_5.1
Oracle Linux 9openexr-devel3.1.1-2.el9_5.1
Oracle Linux 9openexr-libs3.1.1-2.el9_5.1
rapidfort amazon linux 2023openexr3.1.5-1.amzn2023.0.4
rapidfort amazon linux 2023openexr-devel3.1.5-1.amzn2023.0.4
rapidfort amazon linux 2023openexr-libs3.1.5-1.amzn2023.0.4
rapidfort debian 12openexr0:3.1.13-1
rapidfort debian 12rf-openexr0:3.1.13-2
rapidfort debian 13openexr0:3.1.13-1
rapidfort debian 13rf-openexr0:3.1.13-2
rapidfort Oracle Linux 9openexr0:3.1.1-2.el9_5.1
rapidfort Oracle Linux 9openexr-libs0:3.1.1-2.el9_5.1
rapidfort ubuntu 20.04openexr0:3.1.13-2
rapidfort ubuntu 20.04rf-openexr0:3.1.13-2
rapidfort ubuntu 22.04openexr0:3.1.13-2
rapidfort ubuntu 22.04rf-openexr0:3.1.13-2
rapidfort ubuntu 24.04openexr0:3.1.13-2
rapidfort ubuntu 24.04rf-openexr0:3.1.13-2
Red HatOpenEXRno fix listed
Red HatOpenEXR-develno fix listed
Red HatOpenEXR-libsno fix listed
Red Hatgimp:flatpak::OpenEXRno fix listed
Red Hatgimp:flatpak::OpenEXR-develno fix listed
Red Hatgimp:flatpak::OpenEXR-libsno fix listed
rocky 9openexr3.1.1-2.el9_4.1
rocky 9openexr-libs3.1.1-2.el9_4.1
root.io debian 12openexr3.1.5-5.root.io.1, 3.1.5-5.root.io.2, 3.1.5-5.root.io.3, 3.1.5-5.root.io.4, 3.1.5-5.root.io.5, 3.1.5-5.root.io.6, 3.1.5-5.root.io.7, 3.1.5-5.root.io.8, 3.1.5-5.root.io.9, 3.1.5-5.root.io.10, 3.1.5-5.root.io.11, 3.1.5-5.root.io.12, 3.1.5-5.root.io.13, 3.1.5-5.root.io.14, 3.1.5-5.root.io.15, 3.1.5-5.root.io.16, 3.1.5-5.root.io.17, 3.1.5-5.root.io.18, 3.1.5-5.root.io.19, 3.1.5-5.root.io.20, 3.1.5-5.root.io.21
root.io debian 12rootio-openexr3.1.5-5.root.io.1, 3.1.5-5.root.io.2, 3.1.5-5.root.io.3, 3.1.5-5.root.io.4, 3.1.5-5.root.io.5, 3.1.5-5.root.io.6, 3.1.5-5.root.io.7, 3.1.5-5.root.io.8, 3.1.5-5.root.io.9, 3.1.5-5.root.io.10, 3.1.5-5.root.io.11, 3.1.5-5.root.io.12, 3.1.5-5.root.io.13, 3.1.5-5.root.io.14, 3.1.5-5.root.io.15, 3.1.5-5.root.io.16, 3.1.5-5.root.io.17, 3.1.5-5.root.io.18, 3.1.5-5.root.io.19, 3.1.5-5.root.io.20, 3.1.5-5.root.io.21
root.io debian 13rootio-openexr3.1.13-1
ubuntu 24.04openexrno fix listed

References

All 21 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.