Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

GitHub Actions package

afichet/openexr-viewer

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8GitHub ActionsPublished

    memory overflow vulnerability in OpenEXR-viewer

    CVE-2023-50245 · GHSA-99jg-r3f4-rpxj

    Affected
    • GitHub Actions afichet/openexr-viewer < 0.6.1
    Fixed in
    0.6.1· Vendor fix available
    Issue
    Just open this exr file through openexr-viewer. ( poc send by email ) This is windbg log file. [ POC 2 ] (8660.7e44): Access violation - code c0000005 (!!! second chance !!!) openexrviewer+0x27be4: 00007ff713ff7be4 c744880c0000803f mov dword ptr [rax+rcx4+0Ch],3F800000h ds:0000020a3ac8000c=???????? Attempt to write the value 1.0 to the memory address 0x20A3AC8000C [ POC 1 ] (1404.9264): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. openexrviewer+0x27be4: 00007ff713ff7be4 c744880c0000803f mov dword ptr [rax+rcx4+0Ch],3F800000h ds:0000029cb371600c=???????? Attempt to write the value 1.0 to the memory address 0x29CB371600C Credits Team : ZeroPointer 이동하 ( Lee Dong Ha of ZeroPointer Lab ) 정지민 ( Jeong Jimin of ZeroPointer Lab ) 박우진 ( Park Woojin of ZeroPointer Lab ) 전우진 ( Jeon Woojin of ZeroPointer Lab )

    Recommended action: Upgrade to 0.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →