CVE-2020-11759

Name of the Vulnerable Software and Affected Versions OpenEXR versions prior to 2.4.1

Description The issue is related to integer overflows in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock functions, allowing an attacker to write to an out-of-bounds pointer. This can lead to a denial of service. The vulnerability can be exploited by a remote attacker.

Recommendations For versions prior to 2.4.1, update to version 2.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock functions until a patch is available.