CVE catalog

CVE-2021-20298

openexr: CVE-2021-20298

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.57% · Oct 25, 2026

A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to system availability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopenexrsid3.4.16+ds-1fixed
Debianopenexrforky3.4.16+ds-1fixed
Debianopenexrtrixie3.1.13-2fixed
Debianopenexrbookworm3.1.5-5fixed
Ubuntuopenexrpro2.2.1-4.1ubuntu1vulnerable
Ubuntuopenexrpro2.3.0-6vulnerable
Ubuntuopenexrpro2.3.0-6build1vulnerable
Ubuntuopenexrpro2.3.0-6ubuntu0.1vulnerable
Ubuntuopenexrpro2.3.0-6ubuntu0.2vulnerable
Ubuntuopenexrpro2.3.0-6ubuntu0.3vulnerable
Ubuntuopenexrpro2.3.0-6ubuntu0.5vulnerable
Ubuntuopenexrpro2.3.0-6ubuntu0.5+esm1vulnerable
Ubuntuopenexrpro2.3.0-6ubuntu0.5+esm2vulnerable
Opensuseopenexrleap 15.22.2.1-lp152.7.20.1fixed
Opensuseopenexrleap 15.32.2.1-3.35.1fixed
SuseOpenEXRlinux enterprise point of sale 11 sp31.6.1-83.17.30.1fixed
SuseOpenEXRlinux enterprise server 11 sp4-ltss1.6.1-83.17.30.1fixed
Suseopenexrhpe helion openstack 82.1.0-6.37.1fixed
Suseopenexropenstack cloud 82.1.0-6.37.1fixed
Suseopenexropenstack cloud 92.1.0-6.37.1fixed
Suseopenexropenstack cloud crowbar 82.1.0-6.37.1fixed
Suseopenexropenstack cloud crowbar 92.1.0-6.37.1fixed
Suseopenexrlinux enterprise server for sap applications 12 sp32.1.0-6.37.1fixed
Suseopenexrlinux enterprise server for sap applications 12 sp42.1.0-6.37.1fixed
Suseopenexrlinux enterprise software development kit 12 sp52.1.0-6.37.1fixed
Suseopenexrlinux enterprise server 12 sp2-bcl2.1.0-6.37.1fixed
Suseopenexrlinux enterprise server 12 sp3-ltss2.1.0-6.37.1fixed
Suseopenexrlinux enterprise server 12 sp3-bcl2.1.0-6.37.1fixed
Suseopenexrlinux enterprise server 12 sp4-ltss2.1.0-6.37.1fixed
Suseopenexrlinux enterprise server 12 sp52.1.0-6.37.1fixed
Suseopenexrlinux enterprise server for sap applications 12 sp52.1.0-6.37.1fixed
Suseopenexrlinux enterprise workstation extension 12 sp52.1.0-6.37.1fixed
Suseopenexrlinux enterprise module for desktop applications 15 sp22.2.1-3.35.1fixed
Suseopenexrlinux enterprise module for desktop applications 15 sp32.2.1-3.35.1fixed
Suseopenexrlinux enterprise high performance computing 15-espos2.2.1-3.35.1fixed
Suseopenexrlinux enterprise high performance computing 15-ltss2.2.1-3.35.1fixed
Suseopenexrlinux enterprise high performance computing 15 sp1-espos2.2.1-3.35.1fixed
Suseopenexrlinux enterprise high performance computing 15 sp1-ltss2.2.1-3.35.1fixed
Suseopenexrlinux enterprise server 15-ltss2.2.1-3.35.1fixed
Suseopenexrlinux enterprise server 15 sp1-bcl2.2.1-3.35.1fixed
Suseopenexrlinux enterprise server 15 sp1-ltss2.2.1-3.35.1fixed
Suseopenexrlinux enterprise server for sap applications 152.2.1-3.35.1fixed
Suseopenexrlinux enterprise server for sap applications 15 sp12.2.1-3.35.1fixed
Suseopenexrmanager proxy 4.02.2.1-3.35.1fixed
Suseopenexrmanager retail branch server 4.02.2.1-3.35.1fixed
Suseopenexrmanager server 4.02.2.1-3.35.1fixed
Suseopenexrenterprise storage 62.2.1-3.35.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopenexrsourcesid2.5.4-1not yet assignedNot reportedNot reported
Debianopenexrsourceforky2.5.4-1not yet assignedNot reportedNot reported
Debianopenexrsourcetrixie2.5.4-1not yet assignedNot reportedNot reported
Debianopenexrsourcebookworm2.5.4-1not yet assignedNot reportedNot reported
Opensuseopenexrrpmleap 15.22.2.1-lp152.7.20.1Not reportedOPENSUSE-SU-2021:1198-1Not reported
Opensuseopenexrrpmleap 15.32.2.1-3.35.1Not reportedOPENSUSE-SU-2021:2793-1Not reported
SuseOpenEXRrpmlinux enterprise point of sale 11 sp31.6.1-83.17.30.1Not reportedSUSE-SU-2021:14846-1Not reported
SuseOpenEXRrpmlinux enterprise server 11 sp4-ltss1.6.1-83.17.30.1Not reportedSUSE-SU-2021:14846-1Not reported
Suseopenexrrpmhpe helion openstack 82.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmopenstack cloud 82.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmopenstack cloud 92.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmopenstack cloud crowbar 82.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmopenstack cloud crowbar 92.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmlinux enterprise server for sap applications 12 sp32.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmlinux enterprise server for sap applications 12 sp42.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmlinux enterprise software development kit 12 sp52.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmlinux enterprise server 12 sp2-bcl2.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmlinux enterprise server 12 sp3-ltss2.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmlinux enterprise server 12 sp3-bcl2.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmlinux enterprise server 12 sp4-ltss2.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmlinux enterprise server 12 sp52.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmlinux enterprise server for sap applications 12 sp52.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmlinux enterprise workstation extension 12 sp52.1.0-6.37.1Not reportedSUSE-SU-2021:2913-1Not reported
Suseopenexrrpmlinux enterprise module for desktop applications 15 sp22.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmlinux enterprise module for desktop applications 15 sp32.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmlinux enterprise high performance computing 15-espos2.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmlinux enterprise high performance computing 15-ltss2.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmlinux enterprise high performance computing 15 sp1-espos2.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmlinux enterprise high performance computing 15 sp1-ltss2.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmlinux enterprise server 15-ltss2.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmlinux enterprise server 15 sp1-bcl2.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmlinux enterprise server 15 sp1-ltss2.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmlinux enterprise server for sap applications 152.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmlinux enterprise server for sap applications 15 sp12.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmmanager proxy 4.02.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmmanager retail branch server 4.02.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmmanager server 4.02.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported
Suseopenexrrpmenterprise storage 62.2.1-3.35.1Not reportedSUSE-SU-2021:2793-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libopenexr-3-1-30]Fixed

    Source package: [openexr]

    Details (2)

    • 3.1.5-5 · amd64 · bookworm

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · bookworm; dsa · openexr · debian · 12

    • 3.1.5-5 · arm64 · bookworm

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · bookworm; dsa · openexr · debian · 12

  • [libopenexr-dev]Fixed

    Source package: [openexr]

    Details (2)

    • 3.1.5-5 · amd64 · bookworm

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · bookworm; dsa · openexr · debian · 12

    • 3.1.5-5 · arm64 · bookworm

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · bookworm; dsa · openexr · debian · 12

  • [libopenexr-doc]Fixed

    Source package: [openexr]

    Details (2)

    • 3.1.5-5 · all · bookworm

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · bookworm; dsa · openexr · debian · 12

    • 3.1.5-5 · all · bookworm

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · bookworm; dsa · openexr · debian · 12

  • [openexr]Fixed
    Details (2)

    • 3.1.5-5 · amd64 · bookworm

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · bookworm; dsa · openexr · debian · 12

    • 3.1.5-5 · arm64 · bookworm

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · bookworm; dsa · openexr · debian · 12

[Debian 13 (Trixie)]

  • [libopenexr-3-1-30]Fixed

    Source package: [openexr]

    Details (2)

    • 3.1.13-2 · amd64 · trixie

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · 13

    • 3.1.13-2 · arm64 · trixie

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · 13

  • [libopenexr-dev]Fixed

    Source package: [openexr]

    Details (2)

    • 3.1.13-2 · amd64 · trixie

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · 13

    • 3.1.13-2 · arm64 · trixie

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · 13

  • [libopenexr-doc]Fixed

    Source package: [openexr]

    Details (2)

    • 3.1.13-2 · all · trixie

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · 13

    • 3.1.13-2 · all · trixie

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · 13

  • [openexr]Fixed
    Details (2)

    • 3.1.13-2 · amd64 · trixie

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · 13

    • 3.1.13-2 · arm64 · trixie

      Fixed · Fixed: 2.5.4-1

      dsa · openexr · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]