Univention Bugzilla – Bug 52487
openexr: Multiple issues (4.4)
Last modified: 2020-12-16 16:03:43 CET
New Debian openexr 2.2.0-11+deb9u2 fixes: This update addresses the following issues: * A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of service via a crafted EXR file. (CVE-2020-16588) * A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial of service via a crafted EXR file. (CVE-2020-16589)
--- mirror/ftp/4.4/unmaintained/4.4-6/source/openexr_2.2.0-11+deb9u1.dsc +++ apt/ucs_4.4-0-errata4.4-7/source/openexr_2.2.0-11+deb9u2.dsc @@ -1,3 +1,9 @@ +2.2.0-11+deb9u2 [Sun, 13 Dec 2020 15:17:50 +0000] Chris Lamb <lamby@debian.org>: + + * CVE-2020-16588: Prevent a null-pointer deference issue in generatePreview. + * CVE-2020-16589: Prevent a heap-based buffer overflow issue in + writeTileData. + 2.2.0-11+deb9u1 [Sun, 30 Aug 2020 20:26:04 +0300] Adrian Bunk <bunk@debian.org>: * Non-maintainer upload by the LTS team. <http://10.200.17.11/4.4-7/#3509767328430994093>
OK: yaml OK: announce_errata OK: patch FAIL: piuparts Same as last update in bug 51931: Not a major issue: openexr-doc leaves files on system after purge. [4.4-7] 711a93ea92 Bug #52487: openexr 2.2.0-11+deb9u2 doc/errata/staging/openexr.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x837>