VulnerabilityModified
CVE-2020-6147
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files.
HIGH 7.8EPSS 1.45%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. This instance exists in the USDC file format FIELDS section decompression heap overflow.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.45% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-122, CWE-787
- Affected
- pixar/openusd · apple/ipados · apple/iphone os
- Source
- talos-cna@cisco.com
References
- http://seclists.org/fulldisclosure/2020/Nov/20Mailing List, Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1094Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2020/Nov/20Mailing List, Third Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1094Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.