Source: openexr Version: 2.5.4-2 Severity: important Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org> Control: found -1 2.2.1-4.1+deb10u1 Control: found -1 2.2.1-4.1
Hi, The following vulnerability was published for openexr. CVE-2021-26260[0]: | An integer overflow leading to a heap-buffer overflow was found in the | DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could | use this flaw to crash an application compiled with OpenEXR. This is a | different flaw from CVE-2021-23215. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2021-26260 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26260 [1] https://bugzilla.redhat.com/show_bug.cgi?id=1947582 [2] https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29423 [3] https://github.com/AcademySoftwareFoundation/openexr/pull/894 [4] https://github.com/AcademySoftwareFoundation/openexr/commit/4212416433a230334cef0ac122cb8d722746035d Regards, Salvatore
