CVE-2021-3605: 
NixOS vulnerability analysis and mitigation

There's a flaw in OpenEXR's rleUncompress functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted file to an application linked with OpenEXR could cause an out-of-bounds read. The vulnerability was assigned CVE-2021-3605 and was discovered in June 2021 (CVE Mitre, NVD).

The vulnerability is classified as an out-of-bounds read (CWE-125) with a CVSS v3.1 base score of 5.5 (MEDIUM) and vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The flaw exists in the rleUncompress function of OpenEXR, which can be triggered when processing specially crafted files (NVD, Red Hat Bugzilla).

The primary impact of this vulnerability is to application availability, as successful exploitation could lead to application crashes. The vulnerability affects applications linked with OpenEXR versions prior to 3.0.5 (NVD).

The vulnerability has been fixed in OpenEXR version 3.0.5. Users are advised to upgrade to this version or later. Multiple Linux distributions have released security updates to address this vulnerability, including Debian, Gentoo, and Red Hat (Debian Security, Gentoo Security).