CVE-2021-3941

Description

In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition which could affect the availability of programs linked with OpenEXR.

How to fix CVE-2021-3941

To remediate CVE-2021-3941, upgrade the affected package to a fixed version below.

• —upgrade to 2.5.4-2+deb11u1 or later

Is CVE-2021-3941 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 2.5.4-2+deb11u1

CVSS scores

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-3941