CVE-2021-20299: NULL Pointer Dereference

March 16, 2022 (updated December 13, 2022)

A flaw was found in OpenEXR’s Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability.

References

bugs.chromium.org/p/oss-fuzz/issues/detail?id=25740
bugzilla.redhat.com/show_bug.cgi?id=1939154
github.com/AcademySoftwareFoundation/openexr/commit/25e9515b06a6bc293d871622b8cafaee7af84e0f
nvd.nist.gov/vuln/detail/CVE-2021-20299

Code Behaviors & Features

Detect and mitigate CVE-2021-20299 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →