PatchTheCVEtinyexr vulnerabilities and fixes
Recent CVEs affecting tinyexr, with upgrade or downgrade steps. 5 tracked.
tinyexr has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2022-09-06. Highest priority: CVE-2022-34300 (score 54/100).
- CVE-2022-38529 HIGH 7.8 DOWNGRADE tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.
- CVE-2022-34300 HIGH 8.8 DOWNGRADE In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData.
- CVE-2020-19490 MEDIUM 5.5 DOWNGRADE tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR c
- CVE-2020-18430 HIGH 7.5 DOWNGRADE tinyexr 0.9.5 was discovered to contain an array index error in the tinyexr::DecodeEXRImage component, which c
- CVE-2020-18428 HIGH 7.5 DOWNGRADE tinyexr commit 0.9.5 was discovered to contain an array index error in the tinyexr::SaveEXR component, which c
FAQ
How do I fix tinyexr vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is tinyexr being exploited right now?
None of the tracked tinyexr CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which tinyexr CVE should I patch first?
CVE-2022-34300 currently ranks highest (54/100): In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData..