Debian Security Advisory

DLA-3236-1 openexr -- LTS security update

Date Reported:

12 Dec 2022

Affected Packages:

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 986796, Bug 992703, Bug 990450, Bug 990899, Bug 1014828.
In Mitre's CVE dictionary: CVE-2020-16587, CVE-2020-16588, CVE-2020-16589, CVE-2021-3474, CVE-2021-3475, CVE-2021-3476, CVE-2021-3477, CVE-2021-3478, CVE-2021-3479, CVE-2021-3598, CVE-2021-3605, CVE-2021-3933, CVE-2021-3941, CVE-2021-20296, CVE-2021-20298, CVE-2021-20299, CVE-2021-20300, CVE-2021-20302, CVE-2021-20303, CVE-2021-23215, CVE-2021-26260, CVE-2021-45942.

More information:

Multiple security vulnerabilities have been found in OpenEXR, command-line tools and a library for the OpenEXR image format. Buffer overflows or out-of-bound reads could lead to a denial of service (application crash) if a malformed image file is processed.

For Debian 10 buster, these problems have been fixed in version 2.2.1-4.1+deb10u2.

We recommend that you upgrade your openexr packages.

For the detailed security status of openexr please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openexr

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS