PatchTheCVEtinyexr project vulnerabilities
Recent CVEs affecting tinyexr project products. 5 tracked.
tinyexr project has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2022-09-06. Highest priority: CVE-2022-34300 (score 54/100).
- CVE-2022-38529 HIGH 7.8 DOWNGRADE tinyexr commit 0647fb3 was discovered to contain a heap-buffer overflow via the component rleUncompress.
- CVE-2022-34300 HIGH 8.8 DOWNGRADE In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData.
- CVE-2020-19490 MEDIUM 5.5 DOWNGRADE tinyexr 0.9.5 has a integer overflow over-write in tinyexr::DecodePixelData in tinyexr.h, related to OpenEXR c
- CVE-2020-18430 HIGH 7.5 DOWNGRADE tinyexr 0.9.5 was discovered to contain an array index error in the tinyexr::DecodeEXRImage component, which c
- CVE-2020-18428 HIGH 7.5 DOWNGRADE tinyexr commit 0.9.5 was discovered to contain an array index error in the tinyexr::SaveEXR component, which c
FAQ
How do I fix tinyexr project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is tinyexr project being exploited right now?
None of the tracked tinyexr project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which tinyexr project CVE should I patch first?
CVE-2022-34300 currently ranks highest (54/100): In tinyexr 1.0.1, there is a heap-based buffer over-read in tinyexr::DecodePixelData..