Vulnerability in Apple Mac OS X
CVE-2009-1721
The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.043 (90.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 90.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.043 · newest: 0.043 · change: 0.000
Affected products
- Apple Mac OS X
- Openexr — versions 1.2.2, 1.6.1
- Canonical Ubuntu Linux — versions 8.04, 8.10, 9.04
- Debian Linux — versions 4.0, 5.0
- Fedoraproject Fedora — versions 10, 11
- openSUSE — versions 10.0, 10.3, 11.0
Weakness classification (CWE)
References
- www.redhat.com/archives/fedora-package-announce/2009-July/msg01286.html (vendor-advisory, Mailing List)
- support.apple.com/kb/HT3757 (Third Party Advisory)
- secunia.com/advisories/36123 (Broken Link, third-party-advisory)
- www.redhat.com/archives/fedora-package-announce/2009-July/msg01290.html (vendor-advisory, Mailing List)
- www.mandriva.com/security/advisories (vendor-advisory, Broken Link)
- security.debian.org/pool/updates/main/o/openexr/openexr_1.2.2-4.3+etch2.diff.gz (Patch, Broken Link)
- secunia.com/advisories/36753 (Broken Link, third-party-advisory)
- www.vupen.com/english/advisories/2009/2035 (vdb-entry, Broken Link, Vendor Advisory)
- secunia.com/advisories/36096 (Broken Link, third-party-advisory)
- www.debian.org/security/2009/dsa-1842 (vendor-advisory, Mailing List)