UbuntuUpdates.org

Package "openexr"

Name: openexr

Description:

command-line tools for the OpenEXR image format
Latest version: 2.3.0-6ubuntu0.5
Release: focal (20.04)
Level: security
Repository: universe
Homepage: http://www.openexr.com

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "openexr"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "openexr" in Focal

Repository Area Version
base universe 2.3.0-6build1
updates universe 2.3.0-6ubuntu0.5

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2.3.0-6ubuntu0.5 2021-04-01 19:06:25 UTC

  openexr (2.3.0-6ubuntu0.5) focal-security; urgency=medium

  * SECURITY UPDATE: shift overflow in FastHufDecoder
    - debian/patches/CVE-2021-3474.patch: compute Huf codelengths using 64
      bit to prevent shift overflow in IlmImf/ImfFastHuf.cpp.
    - CVE-2021-3474
  * SECURITY UPDATE: integer overflow in calculateNumTiles
    - debian/patches/CVE-2021-3475.patch: compute level size with 64 bits
      to avoid overflow in IlmImf/ImfTiledMisc.cpp.
    - CVE-2021-3475
  * SECURITY UPDATE: shift overflows
    - debian/patches/CVE-2021-3476.patch: ignore unused bits in B44 mode
      detection in IlmImf/ImfB44Compressor.cpp.
    - CVE-2021-3476
  * SECURITY UPDATE: out-of-bounds read via deep tile sample size
    - debian/patches/CVE-2021-3477.patch: fix overflow computing deeptile
      sample table size in IlmImf/ImfDeepTiledInputFile.cpp.
    - CVE-2021-3477
  * SECURITY UPDATE: memory consumption via input file
    - debian/patches/CVE-2021-3478-pre1.patch: reduce size limit for
      scanline files; prevent large chunkoffset allocations in
      IlmImf/ImfCompressor.cpp, IlmImf/ImfCompressor.h, IlmImf/ImfMisc.cpp,
      IlmImf/ImfMultiPartInputFile.cpp, IlmImf/ImfScanLineInputFile.cpp.
    - debian/patches/CVE-2021-3478.patch: sanity check ScanlineInput
      bytesPerLine instead of lineOffset size in
      IlmImf/ImfScanLineInputFile.cpp.
    - CVE-2021-3478
  * SECURITY UPDATE: memory consumption in scanline API
    - debian/patches/CVE-2021-3479-pre1.patch: address issues reported by
      Undefined Behavior Sanitizer in IlmImf/ImfInputFile.cpp.
    - debian/patches/CVE-2021-3479.patch: more efficient handling of filled
      channels reading tiles with scanline API in IlmImf/ImfInputFile.cpp,
      IlmImfTest/testScanLineApi.cpp.
    - CVE-2021-3479

 -- Marc Deslauriers <email address hidden> Thu, 01 Apr 2021 08:47:09 -0400
Source diff to previous version
CVE-2021-3474 There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted input file that is processed by OpenEXR could cause a shift overflow in the FastHu
CVE-2021-3475 There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker who can submit a crafted file to be processed by OpenEXR could cause an integer
CVE-2021-3476 A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to Open
CVE-2021-3477 There's a flaw in OpenEXR's deep tile sample size calculations in vers ...
CVE-2021-3478 There's a flaw in OpenEXR's scanline input file functionality in versi ...
CVE-2021-3479 There's a flaw in OpenEXR's Scanline API functionality in versions bef ...

Version: 2.3.0-6ubuntu0.3 2021-01-05 15:06:24 UTC

  openexr (2.3.0-6ubuntu0.3) focal-security; urgency=medium

  * SECURITY UPDATE: DoS via heap overflow in chunkOffsetReconstruction
    - debian/patches/CVE-2020-16587.patch: properly check chunk offset in
      IlmImf/ImfMultiPartInputFile.cpp.
    - CVE-2020-16587
  * SECURITY UPDATE: DoS via null pointer dereference
    - debian/patches/CVE-2020-16588.patch: fix logic for 1 pixel high/wide
      preview images in exrmakepreview/makePreview.cpp.
    - CVE-2020-16588
  * SECURITY UPDATE: DoS via heap overflow in writeTileData
    - debian/patches/CVE-2020-16589.patch: validate tile coordinates when
      doing copyPixels in IlmImf/ImfTiledInputFile.cpp.
    - CVE-2020-16589

 -- Marc Deslauriers <email address hidden> Fri, 11 Dec 2020 08:20:43 -0500
Source diff to previous version
CVE-2020-16587 A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.
CVE-2020-16588 A Null Pointer Deference issue exists in Academy Software Foundation OpenEXR 2.3.0 in generatePreview in makePreview.cpp that can cause a denial of s
CVE-2020-16589 A head-based buffer overflow exists in Academy Software Foundation OpenEXR 2.3.0 in writeTileData in ImfTiledOutputFile.cpp that can cause a denial o

Version: 2.3.0-6ubuntu0.2 2020-07-06 20:06:51 UTC

  openexr (2.3.0-6ubuntu0.2) focal-security; urgency=medium

  * SECURITY UPDATE: use-after-free in DeepScanLineInputFile
    - debian/patches/CVE-2020-15305.patch: add missing throw in
      deepscanline error handling in IlmImf/ImfDeepScanLineInputFile.cpp.
    - CVE-2020-15305
  * SECURITY UPDATE: heap buffer overflow in getChunkOffsetTableSize()
    - debian/patches/CVE-2020-15306.patch: always ignore chunkCount
      attribute unless it cannot be computed in
      IlmImf/ImfDeepTiledOutputFile.cpp, IlmImf/ImfMisc.cpp,
      IlmImf/ImfMisc.h, IlmImf/ImfMultiPartInputFile.cpp,
      IlmImf/ImfMultiPartOutputFile.cpp.
    - CVE-2020-15306

 -- Marc Deslauriers <email address hidden> Tue, 30 Jun 2020 13:24:21 -0400
Source diff to previous version
CVE-2020-15305 An issue was discovered in OpenEXR before 2.5.2. Invalid input could cause a use-after-free in DeepScanLineInputFile::DeepScanLineInputFile() in IlmI
CVE-2020-15306 An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount attributes could cause a heap buffer overflow in getChunkOffsetTableSize() in Il

Version: 2.3.0-6ubuntu0.1 2020-04-27 14:06:49 UTC

  openexr (2.3.0-6ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: Multiple security issues
    - debian/patches/CVE-2020-117xx/*.patch: backported multiple upstream
      commits to fix a multitude of issues.
    - CVE-2020-11758
    - CVE-2020-11759
    - CVE-2020-11760
    - CVE-2020-11761
    - CVE-2020-11762
    - CVE-2020-11763
    - CVE-2020-11764
    - CVE-2020-11765
  * SECURITY UPDATE: Multiple security issues
    - debian/patches/CVE-2017-911x-2.patch: address pointer overflows in
      IlmImf/ImfScanLineInputFile.cpp, exrenvmap/readInputImage.cpp,
      exrmakepreview/makePreview.cpp.
    - debian/patches/CVE-2017-911x-3.patch: merge common fixes and move
      bounds check to central location in IlmImf/ImfFrameBuffer.h,
      IlmImf/ImfHeader.cpp, exrenvmap/readInputImage.cpp,
      exrmakepreview/makePreview.cpp, exrmaketiled/Image.h,
      exrmultiview/Image.h.
    - debian/patches/CVE-2017-911x-4.patch: refactor origin function to a
      Slice factory and Rgba custom utility in IlmImf/ImfFrameBuffer.cpp,
      IlmImf/ImfFrameBuffer.h, IlmImf/ImfRgbaFile.h,
      exrenvmap/readInputImage.cpp, exrmakepreview/makePreview.cpp,
      exrmaketiled/Image.h, exrmultiview/Image.h.
    - CVE-2017-9111
    - CVE-2017-9113
    - CVE-2017-9115
    - CVE-2018-18444

 -- Marc Deslauriers <email address hidden> Thu, 23 Apr 2020 13:32:15 -0400
CVE-2020-11758 An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h.
CVE-2020-11759 An issue was discovered in OpenEXR before 2.4.1. Because of integer overflows in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCou
CVE-2020-11760 An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp.
CVE-2020-11761 An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refi
CVE-2020-11762 An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when h
CVE-2020-11763 An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp.
CVE-2020-11764 An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
CVE-2020-11765 An issue was discovered in OpenEXR before 2.4.1. There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::Clas
CVE-2017-9111 In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute a
CVE-2017-9113 In OpenEXR 2.2.0, an invalid write of size 1 in the bufferedReadPixels function in ImfInputFile.cpp could cause the application to crash or execute a
CVE-2017-9115 In OpenEXR 2.2.0, an invalid write of size 2 in the = operator function in half.h could cause the application to crash or execute arbitrary code.
CVE-2018-18444 makeMultiView.cpp in exrmultiview in OpenEXR 2.3.0 has an out-of-bounds write, leading to an assertion failure or possibly unspecified other impact.


About   -   Send Feedback to @ubuntu_updates