CVE-2021-3933: Integer Overflow or Wraparound

March 25, 2022 (updated November 9, 2023)

An integer overflow could occur when OpenEXR processes a crafted file on systems where size_t < 64 bits. This could cause an invalid bytesPerLine and maxBytesPerLine value, which could lead to problems with application stability or lead to other attack paths.

References

bugzilla.redhat.com/show_bug.cgi?id=2019783
lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2JSMJ7HLWFPYYV7IAQZD5ZUUUN7RWBN/
nvd.nist.gov/vuln/detail/CVE-2021-3933

Code Behaviors & Features

Detect and mitigate CVE-2021-3933 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →