CVE-2021-3479

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

There's a flaw in OpenEXR's Scanline API functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger excessive consumption of memory, resulting in an impact to system availability.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
n/a	OpenEXR	OpenEXR 3.0.0-beta

References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25370Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1939149Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00001.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00022.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202107-27Third Party Advisory
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25370Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1939149Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/07/msg00001.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00022.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/202107-27Third Party Advisory

Timeline

Published: Mar 31, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-347905.3Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security CVE-2021-347915.3Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security CVE-2021-347927.5A vulnerability in the memory management of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software cou CVE-2021-347938.6A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operat CVE-2021-347945.3A vulnerability in the Simple Network Management Protocol version 3 (SNMPv3) access control functionality of Cisco Adaptive Security Applian CVE-2021-347959.8Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical N CVE-2021-347977.5Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that be CVE-2021-347987.5Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.CVE-2021-34807.5A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unau CVE-2021-348007.5Sensitive information could be logged. The following products are affected: Acronis Agent (Windows, Linux, macOS) before build 27147 CVE-2021-348015.3Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only s CVE-2021-348028.8A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow authenticated users