Multiple crashes in OpenEXR

[Brandon Perry <bperry.volatile () gmail com>]

Attached is a zip file of EXR images that cause segmentation faults in the OpenEXR library (tested against 2.2.0). 
http://www.openexr.com/downloads.html <http://www.openexr.com/downloads.html>

These were reported to ehanway () ilm com <mailto:ehanway () ilm com> on January 12, 2017, but no updates or 
information has been reported back. I have attempted to see what the status is, but no responses from ILM. Since this 
has surpassed the general 90-day mark as is standard for many disclosures, these are being disclosed. It’s actually 
been 120 days exactly.

You can see the last update to the OpenEXR codebase was on January 9. https://github.com/openexr/openexr 
<https://github.com/openexr/openexr>

Of note is that Adobe Photoshop actually ships with a version of OpenEXR for reading EXR images, so some of these 
images also crash Photoshop. ImageMagick also can support EXR image by using the OpenEXR library. 
https://github.com/ImageMagick/exr/tree/master/openexr <https://github.com/ImageMagick/exr/tree/master/openexr>

As of this writing, these issues are unfixed. No CVEs have been requested.

Attachment: signature.asc
Description: Message signed with OpenPGP

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/