{"id":"CVE-2020-15306","details":"An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in IlmImf/ImfMisc.cpp.","modified":"2026-04-02T04:09:53.245453Z","published":"2020-06-26T01:15:10.540Z","related":["MGASA-2021-0015","SUSE-SU-2020:1931-1","SUSE-SU-2020:1984-1","openSUSE-SU-2020:0970-1","openSUSE-SU-2020:1015-1"],"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKDRVXORM2VLNHRLFKS3JHRABSHZ5W5M/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SHYAKRAUEMYVCV7U5WLDRE2YFGSV5PIT/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2020/dsa-4755"},{"type":"ADVISORY","url":"https://github.com/AcademySoftwareFoundation/openexr/blob/master/CHANGES.md"},{"type":"ADVISORY","url":"https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v2.5.2"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/4418-1/"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00025.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00048.html"},{"type":"ADVISORY","url":"https://github.com/AcademySoftwareFoundation/openexr/blob/master/SECURITY.md"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202107-27"},{"type":"FIX","url":"https://github.com/AcademySoftwareFoundation/openexr/pull/738"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/academysoftwarefoundation/openexr","events":[{"introduced":"0"},{"fixed":"24a1bf50bc59a93e80b0fba8fb2450967baa4de7"}]},{"type":"GIT","repo":"https://github.com/openexr/openexr","events":[{"introduced":"0"},{"fixed":"24a1bf50bc59a93e80b0fba8fb2450967baa4de7"}],"database_specific":{"versions":[{"introduced":"0"},{"fixed":"2.5.2"}]}}],"versions":["D_EXR_1_0","ILMBASE_1_0_2","OPENEXR_1_0_4","OPENEXR_1_0_7","OPENEXR_1_1_0","OPENEXR_1_1_1","OPENEXR_1_2_1","OPENEXR_1_2_2","OPENEXR_1_3_0","OPENEXR_1_3_1","OPENEXR_1_3_2","OPENEXR_1_4_0","OPENEXR_1_4_0a","OPENEXR_1_7_0","OPENEXR_VIEWERS_1_0_2","PHOTOSHOP_1_0","start","v1.7.1","v2.0.0","v2.0.0.GM","v2.0.0.beta.1","v2.0.0.beta.2","v2.0.1","v2.1.0","v2.2.0","v2.2.1","v2.2.2","v2.3.0","v2.4.0","v2.4.0-beta.1","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.5.1","v3.0.0-beta","v3.0.1","v3.0.1-beta","v3.0.2","v3.0.3","v3.0.4","v3.0.4-rc1","v3.0.5","v3.0.5-rc1","v3.0.5-rc2","v3.1.0","v3.1.0-rc1","v3.1.1","v3.1.1-rc","v3.1.10","v3.1.10-rc","v3.1.11","v3.1.11-rc","v3.1.12","v3.1.12-rc","v3.1.12-rc2","v3.1.12-rc3","v3.1.12-rc4","v3.1.13","v3.1.13-rc","v3.1.2","v3.1.2-rc","v3.1.2-rc2","v3.1.3","v3.1.3-rc","v3.1.4","v3.1.4-rc","v3.1.5","v3.1.5-rc","v3.1.6","v3.1.6-rc","v3.1.7","v3.1.7-rc","v3.1.8","v3.1.8-rc","v3.1.8-rc2","v3.1.8-rc3","v3.1.8-rc4","v3.1.8-rc5","v3.1.9","v3.1.9-rc","v3.1.9-rc2","v3.1.9-rc3","v3.2.0","v3.2.0-rc","v3.2.0-rc2","v3.2.0-rc3","v3.2.0-rc4","v3.2.1","v3.2.1-rc","v3.2.2","v3.2.2-rc","v3.2.2-rc2","v3.2.3","v3.2.3-rc","v3.2.3-rc2","v3.2.4","v3.2.4-rc","v3.2.4-rc2","v3.2.5","v3.2.5-rc","v3.2.6","v3.2.6-rc","v3.3.0","v3.3.0-rc","v3.3.0-rc1","v3.3.0-rc2","v3.3.1","v3.3.1-rc","v3.3.2","v3.3.2-rc","v3.3.2-rc2","v3.3.2-rc3","v3.3.2-rc4","v3.3.3","v3.3.3-rc","v3.3.3-rc1","v3.3.4","v3.3.4-rc","v3.3.5","v3.3.5-rc","v3.3.5-rc2","v3.3.5-rc3","v3.3.6","v3.3.6-rc","v3.3.6-rc2","v3.3.6-rc3","v3.3.6-rc4","v3.3.7","v3.3.7-rc","v3.3.7-rc2","v3.3.7-rc3","v3.3.7-rc4","v3.3.8","v3.3.8-rc","v3.4-alpha","v3.4.0","v3.4.0-rc","v3.4.0-rc2","v3.4.1","v3.4.1-rc","v3.4.1-rc2","v3.4.2","v3.4.2-rc","v3.4.2-rc2","v3.4.3","v3.4.3-rc","v3.4.3-rc2","v3.4.3-rc3","v3.4.4","v3.4.4-rc","v3.4.4-rc2","v3.4.5","v3.4.5-rc","v3.4.6","v3.4.6-rc","v3.4.7","v3.4.7-rc","v3.4.8","v3.4.8-rc","v3.4.9-rc"],"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"31"}]},{"events":[{"introduced":"0"},{"last_affected":"32"}]},{"events":[{"introduced":"0"},{"last_affected":"15.1"}]},{"events":[{"introduced":"0"},{"last_affected":"15.2"}]},{"events":[{"introduced":"0"},{"last_affected":"9.0"}]},{"events":[{"introduced":"0"},{"last_affected":"10.0"}]},{"events":[{"introduced":"0"},{"last_affected":"16.04"}]},{"events":[{"introduced":"0"},{"last_affected":"18.04"}]},{"events":[{"introduced":"0"},{"last_affected":"19.10"}]},{"events":[{"introduced":"0"},{"last_affected":"20.04"}]}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15306.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}