openexr 2.5.3-2ubuntu0.2 source package in Ubuntu

Changelog

openexr (2.5.3-2ubuntu0.2) groovy-security; urgency=medium

  * SECURITY UPDATE: shift overflow in FastHufDecoder
    - debian/patches/CVE-2021-3474.patch: compute Huf codelengths using 64
      bit to prevent shift overflow in OpenEXR/IlmImf/ImfFastHuf.cpp.
    - CVE-2021-3474
  * SECURITY UPDATE: integer overflow in calculateNumTiles
    - debian/patches/CVE-2021-3475.patch: compute level size with 64 bits
      to avoid overflow in OpenEXR/IlmImf/ImfTiledMisc.cpp.
    - CVE-2021-3475
  * SECURITY UPDATE: shift overflows
    - debian/patches/CVE-2021-3476.patch: ignore unused bits in B44 mode
      detection in OpenEXR/IlmImf/ImfB44Compressor.cpp.
    - CVE-2021-3476
  * SECURITY UPDATE: out-of-bounds read via deep tile sample size
    - debian/patches/CVE-2021-3477.patch: fix overflow computing deeptile
      sample table size in OpenEXR/IlmImf/ImfDeepTiledInputFile.cpp.
    - CVE-2021-3477
  * SECURITY UPDATE: memory consumption via input file
    - debian/patches/CVE-2021-3478-pre1.patch: reduce size limit for
      scanline files; prevent large chunkoffset allocations in
      OpenEXR/IlmImf/ImfCompressor.cpp, OpenEXR/IlmImf/ImfCompressor.h,
      OpenEXR/IlmImf/ImfMisc.cpp, OpenEXR/IlmImf/ImfMisc.h,
      OpenEXR/IlmImf/ImfMultiPartInputFile.cpp,
      OpenEXR/IlmImf/ImfScanLineInputFile.cpp.
    - debian/patches/CVE-2021-3478.patch: sanity check ScanlineInput
      bytesPerLine instead of lineOffset size in
      OpenEXR/IlmImf/ImfScanLineInputFile.cpp.
    - CVE-2021-3478
  * SECURITY UPDATE: memory consumption in scanline API
    - debian/patches/CVE-2021-3479-pre1.patch: address issues reported by
      Undefined Behavior Sanitizer in OpenEXR/IlmImf/ImfInputFile.cpp.
    - debian/patches/CVE-2021-3479.patch: more efficient handling of filled
      channels reading tiles with scanline API in
      OpenEXR/IlmImf/ImfInputFile.cpp,
      OpenEXR/IlmImfTest/testScanLineApi.cpp.
    - CVE-2021-3479

 -- Marc Deslauriers <email address hidden>  Thu, 01 Apr 2021 08:47:09 -0400