CVE-Katalog

CVE-2021-23169

openexr affected and fixed versions

A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.

Schweregrad: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: Mar 17, 2021, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.29% · Oct 27, 2026

Projects and upstream resources

[imath][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	openexr	`2.5.4-2`	FixedDistribution-reported fixed boundary	[CVE-2021-23169]
Debiantrixie	openexr	`3.1.13-2`	Fixed	[CVE-2021-23169]
Debiansid	openexr	`2.5.4-2`	FixedDistribution-reported fixed boundary	[CVE-2021-23169]
Debiansid	openexr	`3.4.16+ds-1`	Fixed	[CVE-2021-23169]
Debianforky	openexr	`2.5.4-2`	FixedDistribution-reported fixed boundary	[CVE-2021-23169]
Debianforky	openexr	`3.4.16+ds-1`	Fixed	[CVE-2021-23169]
Debianbookworm	openexr	`2.5.4-2`	FixedDistribution-reported fixed boundary	[CVE-2021-23169]
Debianbookworm	openexr	`3.1.5-5`	Fixed	[CVE-2021-23169]

Showing 8 fix observations. All 17 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	openexr	`2.5.4-2`	FixedDistribution-reported fixed boundary	[CVE-2021-23169]
Debianbookworm	openexr	`3.1.5-5`	Fixed	[CVE-2021-23169]
Debianforky	openexr	`2.5.4-2`	FixedDistribution-reported fixed boundary	[CVE-2021-23169]
Debianforky	openexr	`3.4.16+ds-1`	Fixed	[CVE-2021-23169]
Debiansid	openexr	`2.5.4-2`	FixedDistribution-reported fixed boundary	[CVE-2021-23169]
Debiansid	openexr	`3.4.16+ds-1`	Fixed	[CVE-2021-23169]
Debiantrixie	openexr	`2.5.4-2`	FixedDistribution-reported fixed boundary	[CVE-2021-23169]
Debiantrixie	openexr	`3.1.13-2`	Fixed	[CVE-2021-23169]
Ubuntupro	openexr	`2.2.1-4.1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-23169]May 8, 2026, 12:25:22 PM UTC
Ubuntupro	openexr	`2.3.0-6`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-23169]May 8, 2026, 12:25:22 PM UTC
Ubuntupro	openexr	`2.3.0-6build1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-23169]May 8, 2026, 12:25:22 PM UTC
Ubuntupro	openexr	`2.3.0-6ubuntu0.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-23169]May 8, 2026, 12:25:22 PM UTC
Ubuntupro	openexr	`2.3.0-6ubuntu0.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-23169]May 8, 2026, 12:25:22 PM UTC
Ubuntupro	openexr	`2.3.0-6ubuntu0.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-23169]May 8, 2026, 12:25:22 PM UTC
Ubuntupro	openexr	`2.3.0-6ubuntu0.5`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-23169]May 8, 2026, 12:25:22 PM UTC
Ubuntupro	openexr	`2.3.0-6ubuntu0.5+esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-23169]May 8, 2026, 12:25:22 PM UTC
Ubuntupro	openexr	`2.3.0-6ubuntu0.5+esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-23169]May 8, 2026, 12:25:22 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "openexr",
      "status": "fixed",
      "release": "sid",
      "version": "3.4.16+ds-1"
    },
    {
      "name": "openexr",
      "status": "fixed",
      "release": "forky",
      "version": "3.4.16+ds-1"
    },
    {
      "name": "openexr",
      "status": "fixed",
      "release": "trixie",
      "version": "3.1.13-2"
    },
    {
      "name": "openexr",
      "status": "fixed",
      "release": "bookworm",
      "version": "3.1.5-5"
    }
  ],
  "fixed_versions": [
    {
      "bug": 988240,
      "name": "openexr",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2.5.4-2"
    },
    {
      "bug": 988240,
      "name": "openexr",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2.5.4-2"
    },
    {
      "bug": 988240,
      "name": "openexr",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2.5.4-2"
    },
    {
      "bug": 988240,
      "name": "openexr",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "2.5.4-2"
    }
  ],
  "distribution_packages": [
    {
      "name": "openexr",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2.2.1-4.1ubuntu1",
        "2.3.0-6",
        "2.3.0-6build1",
        "2.3.0-6ubuntu0.1",
        "2.3.0-6ubuntu0.2",
        "2.3.0-6ubuntu0.3",
        "2.3.0-6ubuntu0.5",
        "2.3.0-6ubuntu0.5+esm1",
        "2.3.0-6ubuntu0.5+esm2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-23169",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-23169",
      "provider_updated_at": "2026-05-08T12:25:22.953708Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #988240]

OpenFactory catalog packages

Die Paketzuordnung läuft.

[Debian 12 (Bookworm)]

[libopenexr-3-1-30]Unbekannt
Quellpaket: [openexr]
Details (2)
- 3.1.5-5 · amd64 · bookworm
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
- 3.1.5-5 · arm64 · bookworm
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
[libopenexr-dev]Unbekannt
Quellpaket: [openexr]
Details (2)
- 3.1.5-5 · amd64 · bookworm
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
- 3.1.5-5 · arm64 · bookworm
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
[libopenexr-doc]Unbekannt
Quellpaket: [openexr]
Details (2)
- 3.1.5-5 · all · bookworm
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
- 3.1.5-5 · all · bookworm
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
[openexr]Unbekannt
Details (2)
- 3.1.5-5 · amd64 · bookworm
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12
- 3.1.5-5 · arm64 · bookworm
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · bookworm; dsa · openexr · debian · 12

[Debian 13 (Trixie)]

[libopenexr-3-1-30]Unbekannt
Quellpaket: [openexr]
Details (2)
- 3.1.13-2 · amd64 · trixie
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · 13
- 3.1.13-2 · arm64 · trixie
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · 13
[libopenexr-dev]Unbekannt
Quellpaket: [openexr]
Details (2)
- 3.1.13-2 · amd64 · trixie
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · 13
- 3.1.13-2 · arm64 · trixie
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · 13
[libopenexr-doc]Unbekannt
Quellpaket: [openexr]
Details (2)
- 3.1.13-2 · all · trixie
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · 13
- 3.1.13-2 · all · trixie
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · 13
[openexr]Unbekannt
Details (2)
- 3.1.13-2 · amd64 · trixie
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · 13
- 3.1.13-2 · arm64 · trixie
  Behoben · Behoben: 2.5.4-2
  dsa · openexr · debian · 13

Beobachtet: Oct 23, 2026, 5:54:52 PM UTC

Referenzen

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]