[Git][security-tracker-team/security-tracker][master] CVE-2021-45942/openexr: dereference uncertain patch

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c2431be4 by Sylvain Beucler at 2022-01-11T17:43:12+01:00
CVE-2021-45942/openexr: dereference uncertain patch
that was derived from automated fuzzing report,
and actually related to another oss-fuzz item.
The CVE notices "db217f2 may be inapplicable."

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2827,7 +2827,7 @@ CVE-2021-45943 (GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCI
 CVE-2021-45942 (OpenEXR 3.1.0 through 3.1.3 has a heap-based buffer overflow in Imf_3_ ...)
 	- openexr <unfixed>
 	NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41416
-	NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/db217f29dfb24f6b4b5100c24ac5e7490e1c57d0
+	NOTE: https://github.com/AcademySoftwareFoundation/openexr/pull/1209
 CVE-2021-45941 (libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (8 bytes) in _ ...)
 	- libbpf <unfixed>
 	NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40957



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c2431be433a5e0d1cc6a31511b041dc6a5b95a05

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c2431be433a5e0d1cc6a31511b041dc6a5b95a05
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220111/fa9bb5a3/attachment.htm>