CVE catalog

CVE-2017-14988

openexr: CVE-2017-14988

Severity: Medium · CVSS 5.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Oct 3, 2017, 1:29:02 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.01% · Oct 25, 2026

Header::readfrom in IlmImf/ImfHeader.cpp in OpenEXR 2.2.0 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file that is accessed with the ImfOpenInputFile function in IlmImf/ImfCRgbaFile.cpp. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	openexr	sid	`3.4.16+ds-1`	fixed
Debian	openexr	forky	`3.4.16+ds-1`	fixed
Debian	openexr	trixie	`3.1.13-2`	fixed
Debian	openexr	bookworm	`3.1.5-5`	fixed
Suse	openexr	linux enterprise module for desktop applications 15	`2.2.1-3.9.2`	fixed
Suse	openexr	linux enterprise module for desktop applications 15 sp1	`2.2.1-3.9.2`	fixed
Suse	openexr	linux enterprise desktop 12 sp4	`2.1.0-6.13.1`	fixed
Suse	openexr	linux enterprise software development kit 12 sp4	`2.1.0-6.13.1`	fixed
Suse	openexr	linux enterprise server 12 sp4	`2.1.0-6.13.1`	fixed
Suse	openexr	linux enterprise server for sap applications 12 sp4	`2.1.0-6.13.1`	fixed
Suse	openexr	linux enterprise workstation extension 12 sp4	`2.1.0-6.13.1`	fixed
Opensuse	openexr	tumbleweed	`3.1.1-2.2`	fixed
Opensuse	openexr	leap 15.0	`2.2.1-lp151.4.6.1`	fixed
Opensuse	openexr	leap 15.1	`2.2.1-lp151.4.6.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	openexr	source	sid	`2.5.3-2`	unimportant	Not reported	[878551]
Debian	openexr	source	forky	`2.5.3-2`	unimportant	Not reported	[878551]
Debian	openexr	source	trixie	`2.5.3-2`	unimportant	Not reported	[878551]
Debian	openexr	source	bookworm	`2.5.3-2`	unimportant	Not reported	[878551]
Suse	openexr	rpm	linux enterprise module for desktop applications 15	`2.2.1-3.9.2`	Not reported	SUSE-SU-2019:2043-1	Not reported
Suse	openexr	rpm	linux enterprise module for desktop applications 15 sp1	`2.2.1-3.9.2`	Not reported	SUSE-SU-2019:2043-1	Not reported
Suse	openexr	rpm	linux enterprise desktop 12 sp4	`2.1.0-6.13.1`	Not reported	SUSE-SU-2019:2014-1	Not reported
Suse	openexr	rpm	linux enterprise software development kit 12 sp4	`2.1.0-6.13.1`	Not reported	SUSE-SU-2019:2014-1	Not reported
Suse	openexr	rpm	linux enterprise server 12 sp4	`2.1.0-6.13.1`	Not reported	SUSE-SU-2019:2014-1	Not reported
Suse	openexr	rpm	linux enterprise server for sap applications 12 sp4	`2.1.0-6.13.1`	Not reported	SUSE-SU-2019:2014-1	Not reported
Suse	openexr	rpm	linux enterprise workstation extension 12 sp4	`2.1.0-6.13.1`	Not reported	SUSE-SU-2019:2014-1	Not reported
Opensuse	openexr	rpm	tumbleweed	`3.1.1-2.2`	Not reported	OPENSUSE-SU-2024:11117-1	Not reported
Opensuse	openexr	rpm	leap 15.0	`2.2.1-lp151.4.6.1`	Not reported	OPENSUSE-SU-2019:1954-1	Not reported
Opensuse	openexr	rpm	leap 15.1	`2.2.1-lp151.4.6.1`	Not reported	OPENSUSE-SU-2019:1954-1	Not reported

[Debian bug #878551]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libopenexr-3-1-30]Affected
Source package: [openexr]
Details (2)
- 3.1.5-5 · amd64 · bookworm
  Affected · Fixed: 2.5.3-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
- 3.1.5-5 · arm64 · bookworm
  Affected · Fixed: 2.5.3-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
[libopenexr-dev]Affected
Source package: [openexr]
Details (2)
- 3.1.5-5 · amd64 · bookworm
  Affected · Fixed: 2.5.3-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
- 3.1.5-5 · arm64 · bookworm
  Affected · Fixed: 2.5.3-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
[libopenexr-doc]Affected
Source package: [openexr]
Details (2)
- 3.1.5-5 · all · bookworm
  Affected · Fixed: 2.5.3-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
- 3.1.5-5 · all · bookworm
  Affected · Fixed: 2.5.3-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
[openexr]Affected
Details (2)
- 3.1.5-5 · amd64 · bookworm
  Affected · Fixed: 2.5.3-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
- 3.1.5-5 · arm64 · bookworm
  Affected · Fixed: 2.5.3-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12

[openSUSE Tumbleweed]

[libIex-3_4-33]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libIex-3_4-33-32bit]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libIex-3_4-33-x86-64-v3]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libIlmThread-3_4-33]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libIlmThread-3_4-33-32bit]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libIlmThread-3_4-33-x86-64-v3]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libOpenEXR-3_4-33]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libOpenEXR-3_4-33-32bit]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libOpenEXR-3_4-33-x86-64-v3]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libOpenEXRCore-3_4-33]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libOpenEXRCore-3_4-33-32bit]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libOpenEXRCore-3_4-33-x86-64-v3]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libOpenEXRUtil-3_4-33]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libOpenEXRUtil-3_4-33-32bit]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[libOpenEXRUtil-3_4-33-x86-64-v3]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed
[openexr-devel]Unknown
Source package: [openexr]
Details (1)
- 3.4.14-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 3.1.1-2.2
  Version impact unknown
  dsa · openexr · opensuse · tumbleweed

Next results

Observed: Oct 23, 2026, 5:26:59 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]