[From nobody Sat Aug 22 12:07:06 2026
Received: (at submit) by bugs.debian.org; 10 Apr 2026 21:04:59 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA,
 FROMDEVELOPER, 
 NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 59; hammy, 150; neutral, 241; spammy,
 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil,
 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian,
 0.000-+--H*Ad:N*Bug
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1wBJ2B-00Cobh-1o
 for submit@bugs.debian.org; Fri, 10 Apr 2026 21:04:59 +0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: openexr: CVE-2026-34378 CVE-2026-34379 CVE-2026-34380 CVE-2026-34543
 CVE-2026-34544 CVE-2026-34545 CVE-2026-34588 CVE-2026-34589
Message-ID: <177585509857.4086505.2707416851458969354.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0
Date: Fri, 10 Apr 2026 23:04:58 +0200
Delivered-To: submit@bugs.debian.org

U291cmNlOiBvcGVuZXhyClZlcnNpb246IDMuNC42K2RzLTQKU2V2ZXJpdHk6IGltcG9ydGFudApU
YWdzOiBzZWN1cml0eSB1cHN0cmVhbQpYLURlYmJ1Z3MtQ2M6IGNhcm5pbEBkZWJpYW4ub3JnLCBE
ZWJpYW4gU2VjdXJpdHkgVGVhbSA8dGVhbUBzZWN1cml0eS5kZWJpYW4ub3JnPgoKSGksCgpUaGUg
Zm9sbG93aW5nIHZ1bG5lcmFiaWxpdGllcyB3ZXJlIHB1Ymxpc2hlZCBmb3Igb3BlbmV4ci4KCkNW
RS0yMDI2LTM0Mzc4WzBdOgp8IE9wZW5FWFIgcHJvdmlkZXMgdGhlIHNwZWNpZmljYXRpb24gYW5k
IHJlZmVyZW5jZSBpbXBsZW1lbnRhdGlvbiBvZgp8IHRoZSBFWFIgZmlsZSBmb3JtYXQsIGFuIGlt
YWdlIHN0b3JhZ2UgZm9ybWF0IGZvciB0aGUgbW90aW9uIHBpY3R1cmUKfCBpbmR1c3RyeS4gRnJv
bSAzLjQuMCB0byBiZWZvcmUgMy40LjksIGEgbWlzc2luZyBib3VuZHMgY2hlY2sgb24gdGhlCnwg
ZGF0YVdpbmRvdyBhdHRyaWJ1dGUgaW4gRVhSIGZpbGUgaGVhZGVycyBhbGxvd3MgYW4gYXR0YWNr
ZXIgdG8KfCB0cmlnZ2VyIGEgc2lnbmVkIGludGVnZXIgb3ZlcmZsb3cgaW4gZ2VuZXJpY191bnBh
Y2soKS4gQnkgc2V0dGluZwp8IGRhdGFXaW5kb3cubWluLnggdG8gYSBsYXJnZSBuZWdhdGl2ZSB2
YWx1ZSwgT3BlbkVYUkNvcmUgY29tcHV0ZXMgYW4KfCBlbm9ybW91cyBpbWFnZSB3aWR0aCwgd2hp
Y2ggaXMgbGF0ZXIgdXNlZCBpbiBhIHNpZ25lZCBpbnRlZ2VyCnwgbXVsdGlwbGljYXRpb24gdGhh
dCBvdmVyZmxvd3MsIGNhdXNpbmcgdGhlIHByb2Nlc3MgdG8gdGVybWluYXRlIHdpdGgKfCBTSUdJ
TEwgdmlhIFVCU2FuLiBUaGlzIHZ1bG5lcmFiaWxpdHkgaXMgZml4ZWQgaW4gMy40LjkuCgoKQ1ZF
LTIwMjYtMzQzNzlbMV06CnwgT3BlbkVYUiBwcm92aWRlcyB0aGUgc3BlY2lmaWNhdGlvbiBhbmQg
cmVmZXJlbmNlIGltcGxlbWVudGF0aW9uIG9mCnwgdGhlIEVYUiBmaWxlIGZvcm1hdCwgYW4gaW1h
Z2Ugc3RvcmFnZSBmb3JtYXQgZm9yIHRoZSBtb3Rpb24gcGljdHVyZQp8IGluZHVzdHJ5LiBGcm9t
IDMuMi4wIHRvIGJlZm9yZSAzLjIuNywgMy4zLjksIGFuZCAzLjQuOSwgYSBtaXNhbGlnbmVkCnwg
bWVtb3J5IHdyaXRlIHZ1bG5lcmFiaWxpdHkgZXhpc3RzIGluIExvc3N5RGN0RGVjb2Rlcl9leGVj
dXRlKCkgaW4KfCBzcmMvbGliL09wZW5FWFJDb3JlL2ludGVybmFsX2R3YV9kZWNvZGVyLmg6NzQ5
LiBXaGVuIGRlY29kaW5nIGEgRFdBCnwgb3IgRFdBQi1jb21wcmVzc2VkIEVYUiBmaWxlIGNvbnRh
aW5pbmcgYSBGTE9BVC10eXBlIGNoYW5uZWwsIHRoZQp8IGRlY29kZXIgcGVyZm9ybXMgYW4gaW4t
cGxhY2UgSEFMRuKGkkZMT0FUIGNvbnZlcnNpb24gYnkgY2FzdGluZyBhbgp8IHVuYWxpZ25lZCB1
aW50OF90ICogcm93IHBvaW50ZXIgdG8gZmxvYXQgKiBhbmQgd3JpdGluZyB0aHJvdWdoIGl0Lgp8
IEJlY2F1c2UgdGhlIHJvdyBidWZmZXIgbWF5IG5vdCBiZSA0LWJ5dGUgYWxpZ25lZCwgdGhpcyBj
b25zdGl0dXRlcwp8IHVuZGVmaW5lZCBiZWhhdmlvciB1bmRlciB0aGUgQyBzdGFuZGFyZCBhbmQg
Y3Jhc2hlcyBpbW1lZGlhdGVseSBvbgp8IGFyY2hpdGVjdHVyZXMgdGhhdCBlbmZvcmNlIGFsaWdu
bWVudCAoQVJNLCBSSVNDLVYsIGV0Yy4pLiBPbiB4ODYgaXQKfCBpcyBzaWxlbnRseSB0b2xlcmF0
ZWQgYXQgcnVudGltZSBidXQgcmVtYWlucyBleHBsb2l0YWJsZSB2aWEKfCBjb21waWxlciBvcHRp
bWl6YXRpb25zIHRoYXQgYXNzdW1lIGFsaWduZWQgYWNjZXNzLiBUaGlzCnwgdnVsbmVyYWJpbGl0
eSBpcyBmaXhlZCBpbiAzLjIuNywgMy4zLjksIGFuZCAzLjQuOS4KCgpDVkUtMjAyNi0zNDM4MFsy
XToKfCBPcGVuRVhSIHByb3ZpZGVzIHRoZSBzcGVjaWZpY2F0aW9uIGFuZCByZWZlcmVuY2UgaW1w
bGVtZW50YXRpb24gb2YKfCB0aGUgRVhSIGZpbGUgZm9ybWF0LCBhbiBpbWFnZSBzdG9yYWdlIGZv
cm1hdCBmb3IgdGhlIG1vdGlvbiBwaWN0dXJlCnwgaW5kdXN0cnkuIEZyb20gMy4yLjAgdG8gYmVm
b3JlIDMuMi43LCAzLjMuOSwgYW5kIDMuNC45LCBhIHNpZ25lZAp8IGludGVnZXIgb3ZlcmZsb3cg
ZXhpc3RzIGluIHVuZG9fcHhyMjRfaW1wbCgpIGluCnwgc3JjL2xpYi9PcGVuRVhSQ29yZS9pbnRl
cm5hbF9weHIyNC5jIGF0IGxpbmUgMzc3LiBUaGUgZXhwcmVzc2lvbgp8ICh1aW50NjRfdCkodyAq
IDMpIGNvbXB1dGVzIHcgKiAzIGFzIGEgc2lnbmVkIDMyLWJpdCBpbnRlZ2VyIGJlZm9yZQp8IGNh
c3RpbmcgdG8gdWludDY0X3QuIFdoZW4gdyBpcyBsYXJnZSwgdGhpcyBtdWx0aXBsaWNhdGlvbgp8
IGNvbnN0aXR1dGVzIHVuZGVmaW5lZCBiZWhhdmlvciB1bmRlciB0aGUgQyBzdGFuZGFyZC4gT24g
dGVzdGVkCnwgYnVpbGRzIChjbGFuZy9nY2Mgd2l0aG91dCBzYW5pdGl6ZXJzKSwgdHdvJ3MtY29t
cGxlbWVudCB3cmFwYXJvdW5kCnwgY29tbW9ubHkgb2NjdXJzLCBhbmQgZm9yIHNwZWNpZmljIHZh
bHVlcyBvZiB3IHRoZSB3cmFwcGVkIHJlc3VsdCBpcwp8IGEgc21hbGwgcG9zaXRpdmUgaW50ZWdl
ciwgd2hpY2ggbWF5IGFsbG93IHRoZSBzdWJzZXF1ZW50IGJvdW5kcwp8IGNoZWNrIHRvIHBhc3Mg
aW5jb3JyZWN0bHkuIElmIHRoZSBjaGVjayBpcyBieXBhc3NlZCwgdGhlIGRlY29kaW5nCnwgbG9v
cCBwcm9jZWVkcyB0byB3cml0ZSBwaXhlbCBkYXRhIHRocm91Z2ggZG91dCwgcG90ZW50aWFsbHkK
fCBleHRlbmRpbmcgZmFyIGJleW9uZCB0aGUgYWxsb2NhdGVkIG91dHB1dCBidWZmZXIuIFRoaXMg
dnVsbmVyYWJpbGl0eQp8IGlzIGZpeGVkIGluIDMuMi43LCAzLjMuOSwgYW5kIDMuNC45LgoKCkNW
RS0yMDI2LTM0NTQzWzNdOgp8IE9wZW5FWFIgcHJvdmlkZXMgdGhlIHNwZWNpZmljYXRpb24gYW5k
IHJlZmVyZW5jZSBpbXBsZW1lbnRhdGlvbiBvZgp8IHRoZSBFWFIgZmlsZSBmb3JtYXQsIGFuIGlt
YWdlIHN0b3JhZ2UgZm9ybWF0IGZvciB0aGUgbW90aW9uIHBpY3R1cmUKfCBpbmR1c3RyeS4gRnJv
bSB2ZXJzaW9uIDMuNC4wIHRvIGJlZm9yZSB2ZXJzaW9uIDMuNC44LCBzZW5zaXRpdmUKfCBpbmZv
cm1hdGlvbiBmcm9tIGhlYXAgbWVtb3J5IG1heSBiZSBsZWFrZWQgdGhyb3VnaCB0aGUgZGVjb2Rl
ZCBwaXhlbAp8IGRhdGEgKGluZm9ybWF0aW9uIGRpc2Nsb3N1cmUpLiBUaGlzIG9jY3VycyB1bmRl
ciBkZWZhdWx0IHNldHRpbmdzOwp8IHNpbXBseSByZWFkaW5nIGEgbWFsaWNpb3VzIEVYUiBmaWxl
IGlzIHN1ZmZpY2llbnQgdG8gdHJpZ2dlciB0aGUKfCBpc3N1ZSwgd2l0aG91dCBhbnkgdXNlciBp
bnRlcmFjdGlvbi4gVGhpcyBpc3N1ZSBoYXMgYmVlbiBwYXRjaGVkIGluCnwgdmVyc2lvbiAzLjQu
OC4KCgpDVkUtMjAyNi0zNDU0NFs0XToKfCBPcGVuRVhSIHByb3ZpZGVzIHRoZSBzcGVjaWZpY2F0
aW9uIGFuZCByZWZlcmVuY2UgaW1wbGVtZW50YXRpb24gb2YKfCB0aGUgRVhSIGZpbGUgZm9ybWF0
LCBhbiBpbWFnZSBzdG9yYWdlIGZvcm1hdCBmb3IgdGhlIG1vdGlvbiBwaWN0dXJlCnwgaW5kdXN0
cnkuIEZyb20gdmVyc2lvbiAzLjQuMCB0byBiZWZvcmUgdmVyc2lvbiAzLjQuOCwgYSBjcmFmdGVk
IEI0NAp8IG9yIEI0NEEgRVhSIGZpbGUgY2FuIGNhdXNlIGFuIG91dC1vZi1ib3VuZHMgd3JpdGUg
aW4gYW55IGFwcGxpY2F0aW9uCnwgdGhhdCBkZWNvZGVzIGl0IHZpYSBleHJfZGVjb2RpbmdfcnVu
KCkuIENvbnNlcXVlbmNlcyByYW5nZSBmcm9tCnwgaW1tZWRpYXRlIGNyYXNoIChtb3N0IGxpa2Vs
eSkgdG8gY29ycnVwdGlvbiBvZiBhZGphY2VudCBoZWFwCnwgYWxsb2NhdGlvbnMgKGxheW91dC1k
ZXBlbmRlbnQpLiBUaGlzIGlzc3VlIGhhcyBiZWVuIHBhdGNoZWQgaW4KfCB2ZXJzaW9uIDMuNC44
LgoKCkNWRS0yMDI2LTM0NTQ1WzVdOgp8IE9wZW5FWFIgcHJvdmlkZXMgdGhlIHNwZWNpZmljYXRp
b24gYW5kIHJlZmVyZW5jZSBpbXBsZW1lbnRhdGlvbiBvZgp8IHRoZSBFWFIgZmlsZSBmb3JtYXQs
IGFuIGltYWdlIHN0b3JhZ2UgZm9ybWF0IGZvciB0aGUgbW90aW9uIHBpY3R1cmUKfCBpbmR1c3Ry
eS4gRnJvbSB2ZXJzaW9uIDMuNC4wIHRvIGJlZm9yZSB2ZXJzaW9uIDMuNC43LCBhbiBhdHRhY2tl
cgp8IHByb3ZpZGluZyBhIGNyYWZ0ZWQgLmV4ciBmaWxlIHdpdGggSFRKMksgY29tcHJlc3Npb24g
YW5kIGEgY2hhbm5lbAp8IHdpZHRoIG9mIDMyNzY4IGNhbiB3cml0ZSBjb250cm9sbGVkIGRhdGEg
YmV5b25kIHRoZSBvdXRwdXQgaGVhcAp8IGJ1ZmZlciBpbiBhbnkgYXBwbGljYXRpb24gdGhhdCBk
ZWNvZGVzIEVYUiBpbWFnZXMuIFRoZSB3cml0ZQp8IHByaW1pdGl2ZSBpcyAyIGJ5dGVzIHBlciBv
dmVyZmxvdyBpdGVyYXRpb24gb3IgNCBieXRlcyAoYnkgYW5vdGhlcgp8IHBhdGgpLCByZXBlYXRp
bmcgZm9yIGVhY2ggYWRkaXRpb25hbCBwaXhlbCBwYXN0IHRoZSBvdmVyZmxvdyBwb2ludC4KfCBJ
biB0aGlzIGNvbnRleHQsIGEgaGVhcCB3cml0ZSBvdmVyZmxvdyBjYW4gbGVhZCB0byByZW1vdGUg
Y29kZQp8IGV4ZWN1dGlvbiBvbiBzeXN0ZW1zLiBUaGlzIGlzc3VlIGhhcyBiZWVuIHBhdGNoZWQg
aW4gdmVyc2lvbiAzLjQuNy4KCgpDVkUtMjAyNi0zNDU4OFs2XToKfCBPcGVuRVhSIHByb3ZpZGVz
IHRoZSBzcGVjaWZpY2F0aW9uIGFuZCByZWZlcmVuY2UgaW1wbGVtZW50YXRpb24gb2YKfCB0aGUg
RVhSIGZpbGUgZm9ybWF0LCBhbiBpbWFnZSBzdG9yYWdlIGZvcm1hdCBmb3IgdGhlIG1vdGlvbiBw
aWN0dXJlCnwgaW5kdXN0cnkuIEZyb20gMy4xLjAgdG8gYmVmb3JlIDMuMi43LCAzLjMuOSwgYW5k
IDMuNC45LAp8IGludGVybmFsX2V4cl91bmRvX3BpeigpIGFkdmFuY2VzIHRoZSB3b3JraW5nIHdh
dmVsZXQgcG9pbnRlciB3aXRoCnwgc2lnbmVkIDMyLWJpdCBhcml0aG1ldGljLiBCZWNhdXNlIG54
LCBueSwgYW5kIHdjb3VudCBhcmUgaW50LCBhCnwgY3JhZnRlZCBFWFIgZmlsZSBjYW4gbWFrZSB0
aGlzIHByb2R1Y3Qgb3ZlcmZsb3cgYW5kIHdyYXAuIFRoZSBuZXh0CnwgY2hhbm5lbCB0aGVuIGRl
Y29kZXMgZnJvbSBhbiBpbmNvcnJlY3QgYWRkcmVzcy4gVGhlIHdhdmVsZXQgZGVjb2RlCnwgcGF0
aCBvcGVyYXRlcyBpbiBwbGFjZSwgc28gdGhpcyB5aWVsZHMgYm90aCBvdXQtb2YtYm91bmRzIHJl
YWRzIGFuZAp8IG91dC1vZi1ib3VuZHMgd3JpdGVzLiBUaGlzIHZ1bG5lcmFiaWxpdHkgaXMgZml4
ZWQgaW4gMy4yLjcsIDMuMy45LAp8IGFuZCAzLjQuOS4KCgpDVkUtMjAyNi0zNDU4OVs3XToKfCBP
cGVuRVhSIHByb3ZpZGVzIHRoZSBzcGVjaWZpY2F0aW9uIGFuZCByZWZlcmVuY2UgaW1wbGVtZW50
YXRpb24gb2YKfCB0aGUgRVhSIGZpbGUgZm9ybWF0LCBhbiBpbWFnZSBzdG9yYWdlIGZvcm1hdCBm
b3IgdGhlIG1vdGlvbiBwaWN0dXJlCnwgaW5kdXN0cnkuIEZyb20gMy4yLjAgdG8gYmVmb3JlIDMu
Mi43LCAzLjMuOSwgYW5kIDMuNC45LCB0aGUgRFdBCnwgbG9zc3kgZGVjb2RlciBjb25zdHJ1Y3Rz
IHRlbXBvcmFyeSBwZXItY29tcG9uZW50IGJsb2NrIHBvaW50ZXJzCnwgdXNpbmcgc2lnbmVkIDMy
LWJpdCBhcml0aG1ldGljLiBGb3IgYSBsYXJnZSBlbm91Z2ggd2lkdGgsIHRoZQp8IGNhbGN1bGF0
aW9uIG92ZXJmbG93cyBhbmQgbGF0ZXIgZGVjb2RlciBzdG9yZXMgb3BlcmF0ZSBvbiBhIHdyYXBw
ZWQKfCBwb2ludGVyIG91dHNpZGUgdGhlIGFsbG9jYXRlZCByb3dCbG9jayBiYWNraW5nIHN0b3Jl
LiBUaGlzCnwgdnVsbmVyYWJpbGl0eSBpcyBmaXhlZCBpbiAzLjIuNywgMy4zLjksIGFuZCAzLjQu
OS4KCgpJZiB5b3UgZml4IHRoZSB2dWxuZXJhYmlsaXRpZXMgcGxlYXNlIGFsc28gbWFrZSBzdXJl
IHRvIGluY2x1ZGUgdGhlCkNWRSAoQ29tbW9uIFZ1bG5lcmFiaWxpdGllcyAmIEV4cG9zdXJlcykg
aWRzIGluIHlvdXIgY2hhbmdlbG9nIGVudHJ5LgoKRm9yIGZ1cnRoZXIgaW5mb3JtYXRpb24gc2Vl
OgoKWzBdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3RyYWNrZXIvQ1ZFLTIw
MjYtMzQzNzgKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lkPUNWRS0yMDI2LTM0
Mzc4ClsxXSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9yZy90cmFja2VyL0NWRS0y
MDI2LTM0Mzc5CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9pZD1DVkUtMjAyNi0z
NDM3OQpbMl0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tlci9DVkUt
MjAyNi0zNDM4MAogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZFLTIwMjYt
MzQzODAKWzNdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3RyYWNrZXIvQ1ZF
LTIwMjYtMzQ1NDMKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lkPUNWRS0yMDI2
LTM0NTQzCls0XSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9yZy90cmFja2VyL0NW
RS0yMDI2LTM0NTQ0CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9pZD1DVkUtMjAy
Ni0zNDU0NApbNV0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJhY2tlci9D
VkUtMjAyNi0zNDU0NQogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9Q1ZFLTIw
MjYtMzQ1NDUKWzZdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3RyYWNrZXIv
Q1ZFLTIwMjYtMzQ1ODgKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lkPUNWRS0y
MDI2LTM0NTg4Cls3XSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9yZy90cmFja2Vy
L0NWRS0yMDI2LTM0NTg5CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9pZD1DVkUt
MjAyNi0zNDU4OQoKUmVnYXJkcywKU2FsdmF0b3JlCg==
]