Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-99jg-r3f4-rpxj

Опубликовано: 12 дек. 2023
Источник: github
Github: Прошло ревью
CVSS3: 9.8

Описание

memory overflow vulnerability in OpenEXR-viewer

Just open this exr file through openexr-viewer.

( poc send by email )

This is windbg log file.

[ POC 2 ] (8660.7e44): Access violation - code c0000005 (!!! second chance !!!) openexr_viewer+0x27be4: 00007ff713ff7be4 c744880c0000803f mov dword ptr [rax+rcx*4+0Ch],3F800000h ds:0000020a3ac8000c=????????

Attempt to write the value 1.0 to the memory address 0x20A3AC8000C

[ POC 1 ] (1404.9264): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. openexr_viewer+0x27be4: 00007ff713ff7be4 c744880c0000803f mov dword ptr [rax+rcx*4+0Ch],3F800000h ds:0000029cb371600c=????????

Attempt to write the value 1.0 to the memory address 0x29CB371600C

Credits Team : ZeroPointer 이동하 ( Lee Dong Ha of ZeroPointer Lab ) 정지민    ( Jeong Jimin of ZeroPointer Lab ) 박우진    ( Park Woojin of ZeroPointer Lab ) 전우진    ( Jeon Woojin of ZeroPointer Lab )

Пакеты

Наименование

afichet/openexr-viewer

actions
Затронутые версииВерсия исправления

< 0.6.1

0.6.1

EPSS

Процентиль: 87%
0.03324
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-120

Связанные уязвимости

CVSS3: 9.8
nvd
около 2 лет назад

OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed in version 0.6.1.

EPSS

Процентиль: 87%
0.03324
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-120