[Git][security-tracker-team/security-tracker][master] Reserve DLA-2701-1 for openexr
Sylvain Beucler (@beuc)
beuc at debian.org
Sat Jul 3 19:04:15 BST 2021
Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker
Commits:
f7ee7c32 by Sylvain Beucler at 2021-07-03T20:03:25+02:00
Reserve DLA-2701-1 for openexr
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -15252,7 +15252,6 @@ CVE-2021-3479 (There's a flaw in OpenEXR's Scanline API functionality in version
- openexr <unfixed> (bug #986796)
[bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
- [stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25370
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/d80f11f4f55100d007ae80a162bf257ec291612c
NOTE: https://github.com/AcademySoftwareFoundation/openexr/pull/830
@@ -15260,7 +15259,6 @@ CVE-2021-3478 (There's a flaw in OpenEXR's scanline input file functionality in
- openexr <unfixed> (bug #986796)
[bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
- [stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27409
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1939160
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/bc88cdb6c97fbf5bc5d11ad8ca55306da931283a
@@ -15269,7 +15267,6 @@ CVE-2021-3477 (There's a flaw in OpenEXR's deep tile sample size calculations in
- openexr <unfixed> (bug #986796)
[bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
- [stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26956
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1939159
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/467be80b75642efbbe6bdace558079f68c16acb1
@@ -15852,21 +15849,18 @@ CVE-2021-3476 (A flaw was found in OpenEXR's B44 uncompression functionality in
- openexr <unfixed> (bug #986796)
[bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
- [stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24787
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/eec0dba242bedd2778c973ae4af112107b33d9c9
CVE-2021-3475 (There is a flaw in OpenEXR in versions before 3.0.0-beta. An attacker ...)
- openexr <unfixed> (bug #986796)
[bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
- [stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25297
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/2a18ed424a854598c2a20b5dd7e782b436a1e753
CVE-2021-3474 (There's a flaw in OpenEXR in versions before 3.0.0-beta. A crafted inp ...)
- openexr <unfixed> (bug #986796)
[bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
- [stretch] - openexr <postponed> (Minor issue; can be fixed in next update)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24831
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/c3ed4a1db1f39bf4524a644cb2af81dc8cfab33f
NOTE: Introduced by https://github.com/AcademySoftwareFoundation/openexr/commit/7f0c9e256f34cac5a31e9d9cce00ccc898f49f3b (v2.2.0)
@@ -38714,7 +38708,6 @@ CVE-2021-20296 (A flaw was found in OpenEXR in versions before 3.0.0-beta. A cra
- openexr <unfixed> (bug #986796)
[bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
- [stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24854
NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/b0c63c0b96eb9b0d3998f603e12f9f414fb0d44a
CVE-2021-20295 [Regression of CVE-2020-10756 fix in virt:rhel/qemu-kvm in Red Hat Enterprise Linux 8.3]
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[03 Jul 2021] DLA-2701-1 openexr - security update
+ {CVE-2020-16587 CVE-2021-3474 CVE-2021-3475 CVE-2021-3476 CVE-2021-3477 CVE-2021-3478 CVE-2021-3479 CVE-2021-3598 CVE-2021-20296 CVE-2021-23215 CVE-2021-26260}
+ [stretch] - openexr 2.2.0-11+deb9u3
[01 Jul 2021] DLA-2700-1 htmldoc - security update
{CVE-2019-19630 CVE-2021-20308 CVE-2021-23158 CVE-2021-23165 CVE-2021-23180 CVE-2021-23191 CVE-2021-23206 CVE-2021-26252 CVE-2021-26259 CVE-2021-26948}
[stretch] - htmldoc 1.8.27-8+deb9u1
=====================================
data/dla-needed.txt
=====================================
@@ -82,9 +82,6 @@ nvidia-graphics-drivers
NOTE: package is in non-free but also in packages-to-support
NOTE: only CVE‑2021‑1076 seems to be fixed in the R390 branch used in Stretch, no fix available for CVE-2021-1077
--
-openexr (Sylvain Beucler)
- NOTE: 20210626: triaging backlog, porting patches (Beuc)
---
python-babel
NOTE: 20210617: CVE ID rejected. (abhijith)
NOTE: 20210620: http://people.debian.org/~abhijith/backport_of_3a700b5.patch (abhijith)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f7ee7c32f7921b923001e87c560f64da6cc6fe84
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f7ee7c32f7921b923001e87c560f64da6cc6fe84
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210703/8dbd27ed/attachment.htm>
More information about the debian-security-tracker-commits
mailing list