CVE-2021-3941: debian debian_linux Divide By Zero
Vulnerability summary
CVE-2021-3941 is a medium (CVSS 6.5) Divide By Zero vulnerability in debian debian_linux. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 9 · Related 6Timeline
- 25-03-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In ImfChromaticities.cpp routine RGBtoXYZ(), there are some division operations such as `float Z = (1 - chroma.white.x - chroma.white.y) * Y / chroma.white.y;` and `chroma.green.y * (X + Z))) / d;` but the divisor is not checked for a 0 value. A specially crafted file could trigger a divide-by-zero condition which could affect the availability of programs linked with OpenEXR.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
0.00 pp
From 0.30% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- openexr< 3.1.5-2
- debian_linuxEOL10.0 | 11.0
Fedoraproject1 product
- fedoraEOL34 | 35 | 36
Openexr1 product
- openexr3.1.2
Redhat1 product
- enterprise_linuxEOL6.0 | 7.0 | 8.0
Ubuntu1 product
- openexr< 2.2.0-10ubuntu2.6+esm3 | < 2.2.0-11.1ubuntu1.9 | < 2.3.0-6ubuntu0.5+esm1 | < 2.5.7-1ubuntu0.1~esm1
5 vendors · 6 products
References
11 links- lists.fedoraproject.org/archives/…Vendor Advisory
