[From nobody Sat Aug 22 12:07:09 2026 Received: (at submit) by bugs.debian.org; 8 May 2026 13:13:01 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-4.9 required=4.0 tests=BAYES_00, FOURLA, MD5_SHA1_SUM, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 28; hammy, 149; neutral, 74; spammy, 1. spammytokens:0.981-+--industry hammytokens:0.000-+--UD:security-tracker.debian.org, 0.000-+--security-tracker.debian.org, 0.000-+--securitytrackerdebianorg, 0.000-+--H*r:jmm, 0.000-+--sk:teamse Return-path: <jmm@inutil.org> Received: from inutil.org ([51.38.114.215]:55564 helo=vps-b7ad3695.vps.ovh.net) by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <jmm@inutil.org>) id 1wLL0l-000jql-2t for submit@bugs.debian.org; Fri, 08 May 2026 13:13:01 +0000 Received: from soju.westfalen.local (p548dc5fc.dip0.t-ipconnect.de [84.141.197.252]) by vps-b7ad3695.vps.ovh.net (Postfix) with ESMTPSA id ED19A1F9 for <submit@bugs.debian.org>; Fri, 8 May 2026 13:12:58 +0000 (UTC) Received: from jmm by soju.westfalen.local with local (Exim 4.99.2) (envelope-from <jmm@soju.westfalen.local>) id 1wLL0m-00000006zGA-2k82 for submit@bugs.debian.org; Fri, 08 May 2026 15:13:00 +0200 Date: Fri, 8 May 2026 15:13:00 +0200 To: submit@bugs.debian.org Subject: openexr: CVE-2026-42216 CVE-2026-42217 Message-ID: <af3hXIBRY02g0x0G@pisco.westfalen.local> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline From: =?UTF-8?Q?Moritz_M=C3=BChlenhoff?= <jmm@inutil.org> Delivered-To: submit@bugs.debian.org Source: openexr X-Debbugs-CC: team@security.debian.org Severity: grave Tags: security Hi, The following vulnerabilities were published for openexr. CVE-2026-42216[0]: | OpenEXR provides the specification and reference implementation of | the EXR file format, an image storage format for the motion picture | industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before | 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs | strings from a prefix-compressed representation. If the previous | string is longer than 255 bytes, the next string is expected to | begin with a 2-byte prefix length. The code reads stringList[i][0] | and stringList[i][1] without checking that the current string has at | least two bytes. This issue has been patched in versions 3.2.9, | 3.3.11, and 3.4.11. https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-65j8-95g9-jgj4 CVE-2026-42217[1]: | OpenEXR provides the specification and reference implementation of | the EXR file format, an image storage format for the motion picture | industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before | 3.3.11, and 3.4.0 to before 3.4.11, readVariableLengthInteger() | decodes a variable-length integer from untrusted EXR input without | bounding the shift count. After enough continuation bytes, the code | executes a left shift by 70 on a 64-bit value, which is undefined | behavior. This issue has been patched in versions 3.2.9, 3.3.11, and | 3.4.11. https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3c67-4wwp-w52m https://github.com/AcademySoftwareFoundation/openexr/pull/2378 Fixed by: https://github.com/AcademySoftwareFoundation/openexr/commit/21eaa33bcbbb0c83a5fc42f6b6d65b70a996e63c If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-42216 https://www.cve.org/CVERecord?id=CVE-2026-42216 [1] https://security-tracker.debian.org/tracker/CVE-2026-42217 https://www.cve.org/CVERecord?id=CVE-2026-42217 Please adjust the affected versions in the BTS as needed. ]