-
openexr (2.2.0-10ubuntu2.6) xenial-security; urgency=medium
* SECURITY UPDATE: shift overflow in FastHufDecoder
- debian/patches/CVE-2021-3474.patch: compute Huf codelengths using 64
bit to prevent shift overflow in IlmImf/ImfFastHuf.cpp.
- CVE-2021-3474
* SECURITY UPDATE: integer overflow in calculateNumTiles
- debian/patches/CVE-2021-3475.patch: compute level size with 64 bits
to avoid overflow in IlmImf/ImfTiledMisc.cpp.
- CVE-2021-3475
* SECURITY UPDATE: shift overflows
- debian/patches/CVE-2021-3476.patch: ignore unused bits in B44 mode
detection in IlmImf/ImfB44Compressor.cpp.
- CVE-2021-3476
* SECURITY UPDATE: out-of-bounds read via deep tile sample size
- debian/patches/CVE-2021-3477.patch: fix overflow computing deeptile
sample table size in IlmImf/ImfDeepTiledInputFile.cpp.
- CVE-2021-3477
* SECURITY UPDATE: memory consumption via input file
- debian/patches/CVE-2021-3478-pre1.patch: reduce size limit for
scanline files; prevent large chunkoffset allocations in
IlmImf/ImfCompressor.cpp, IlmImf/ImfCompressor.h, IlmImf/ImfMisc.cpp,
IlmImf/ImfMultiPartInputFile.cpp, IlmImf/ImfScanLineInputFile.cpp.
- debian/patches/CVE-2021-3478.patch: sanity check ScanlineInput
bytesPerLine instead of lineOffset size in
IlmImf/ImfScanLineInputFile.cpp.
- CVE-2021-3478
* SECURITY UPDATE: memory consumption in scanline API
- debian/patches/CVE-2021-3479-pre1.patch: address issues reported by
Undefined Behavior Sanitizer in IlmImf/ImfInputFile.cpp.
- debian/patches/CVE-2021-3479.patch: more efficient handling of filled
channels reading tiles with scanline API in IlmImf/ImfInputFile.cpp,
IlmImfTest/testScanLineApi.cpp.
- CVE-2021-3479
-- Marc Deslauriers <email address hidden> Thu, 01 Apr 2021 08:47:09 -0400
-
openexr (2.2.0-10ubuntu2.4) xenial-security; urgency=medium
* SECURITY UPDATE: DoS via heap overflow in chunkOffsetReconstruction
- debian/patches/CVE-2020-16587.patch: properly check chunk offset in
IlmImf/ImfMultiPartInputFile.cpp.
- CVE-2020-16587
* SECURITY UPDATE: DoS via null pointer dereference
- debian/patches/CVE-2020-16588.patch: fix logic for 1 pixel high/wide
preview images in exrmakepreview/makePreview.cpp.
- CVE-2020-16588
* SECURITY UPDATE: DoS via heap overflow in writeTileData
- debian/patches/CVE-2020-16589.patch: validate tile coordinates when
doing copyPixels in IlmImf/ImfTiledInputFile.cpp.
- CVE-2020-16589
-- Marc Deslauriers <email address hidden> Fri, 11 Dec 2020 08:27:00 -0500
-
openexr (2.2.0-10ubuntu2.3) xenial-security; urgency=medium
* SECURITY UPDATE: use-after-free in DeepScanLineInputFile
- debian/patches/CVE-2020-15305.patch: add missing throw in
deepscanline error handling in IlmImf/ImfDeepScanLineInputFile.cpp.
- CVE-2020-15305
* SECURITY UPDATE: heap buffer overflow in getChunkOffsetTableSize()
- debian/patches/CVE-2020-15306.patch: always ignore chunkCount
attribute unless it cannot be computed in
IlmImf/ImfDeepTiledOutputFile.cpp, IlmImf/ImfMisc.cpp,
IlmImf/ImfMisc.h, IlmImf/ImfMultiPartInputFile.cpp,
IlmImf/ImfMultiPartOutputFile.cpp.
- CVE-2020-15306
-- Marc Deslauriers <email address hidden> Tue, 30 Jun 2020 14:24:45 -0400
-
openexr (2.2.0-10ubuntu2.2) xenial-security; urgency=medium
* SECURITY UPDATE: Multiple security issues
- debian/patches/CVE-2020-117xx/*.patch: backported multiple upstream
commits to fix a multitude of issues.
- CVE-2020-11758
- CVE-2020-11759
- CVE-2020-11760
- CVE-2020-11761
- CVE-2020-11762
- CVE-2020-11763
- CVE-2020-11764
- CVE-2020-11765
-- Marc Deslauriers <email address hidden> Fri, 24 Apr 2020 07:32:37 -0400
-
openexr (2.2.0-10ubuntu2.1) xenial-security; urgency=medium
* SECURITY UPDATE: Multiple security issues
- debian/patches/CVE-2017-911x.patch: add additional input validation
in IlmImf/ImfDwaCompressor.cpp, IlmImf/ImfHuf.cpp,
IlmImf/ImfPizCompressor.cpp.
- debian/patches/CVE-2017-911x-2.patch: address pointer overflows in
IlmImf/ImfScanLineInputFile.cpp, exrenvmap/readInputImage.cpp,
exrmakepreview/makePreview.cpp.
- debian/patches/CVE-2017-911x-3.patch: merge common fixes and move
bounds check to central location in IlmImf/ImfFrameBuffer.h,
IlmImf/ImfHeader.cpp, exrenvmap/readInputImage.cpp,
exrmakepreview/makePreview.cpp, exrmaketiled/Image.h,
exrmultiview/Image.h.
- debian/patches/CVE-2017-911x-4.patch: refactor origin function to a
Slice factory and Rgba custom utility in IlmImf/ImfFrameBuffer.cpp,
IlmImf/ImfFrameBuffer.h, IlmImf/ImfRgbaFile.h,
exrenvmap/readInputImage.cpp, exrmakepreview/makePreview.cpp,
exrmaketiled/Image.h, exrmultiview/Image.h.
- CVE-2017-9110
- CVE-2017-9111
- CVE-2017-9112
- CVE-2017-9113
- CVE-2017-9115
- CVE-2017-9116
- CVE-2017-12596
- CVE-2018-18444
-- Marc Deslauriers <email address hidden> Wed, 02 Oct 2019 13:52:52 -0400
-
openexr (2.2.0-10ubuntu2) xenial; urgency=medium
* Add ppc64el to the archs where to ignore test results.
-- Matthias Klose <email address hidden> Sun, 17 Apr 2016 20:13:32 +0200
-
openexr (2.2.0-10ubuntu1) xenial; urgency=medium
* Merge with Debian; remaining changes:
openexr (2.2.0-10) unstable; urgency=medium
* debian/patches/: patchset updated
- bug815594.patch added (Closes: #815594)
* debian/control: S-V bump 3.9.6 -> 3.9.7 (no changes needed)
-- Matthias Klose <email address hidden> Tue, 05 Apr 2016 15:10:37 +0200
-
openexr (2.2.0-9ubuntu1) xenial; urgency=low
* Merge from Debian unstable. Remaining changes:
- Mark as optional symbols that aren't exported when building with -O3.
openexr (2.2.0-9) unstable; urgency=medium
* Upload to unstable
* debian/control: git:// -> https:// for Vcs-* fields
openexr (2.2.0-8) experimental; urgency=medium
* Make sure to use latest of ilmbase
-- Steve Langasek <email address hidden> Mon, 01 Feb 2016 21:19:48 -0800
-
openexr (2.2.0-7ubuntu1) xenial; urgency=medium
* Mark as optional symbols that aren't exported when building with -O3.
-- Steve Langasek <email address hidden> Sat, 05 Dec 2015 00:12:51 +0000
-
openexr (2.2.0-7) experimental; urgency=medium
* Fix symbols on armel/powerpc/armhf
-- Mathieu Malaterre <email address hidden> Mon, 19 Oct 2015 14:47:28 +0200
-
openexr (2.2.0-1ubuntu3) wily; urgency=medium
* Fix tests on big endian targets (taken from Fedora).
* Ignore test results on 32bit archs.
-- Matthias Klose <email address hidden> Thu, 06 Aug 2015 00:23:37 +0200
