[Git][security-tracker-team/security-tracker][master] new openexr issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7b093e55 by Moritz Muehlenhoff at 2026-08-25T23:20:06+02:00
new openexr issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -274,7 +274,13 @@ CVE-2026-67578 (FA-50 all versions miss authentication for some configuration. A
 CVE-2026-66882 (Improper Neutralization of Input During Web Page Generation (XSS) vuln ...)
 	NOT-FOR-US: team-alembic AshAuthentication
 CVE-2026-65979 (OpenEXR is the reference implementation and specification for the EXR  ...)
-	TODO: check
+	- openexr 3.4.14-0.1
+	[trixie] - openexr <not-affected> (Vulnerable code not present, introduced in 3.4.0)
+	[bookworm] - openexr <not-affected> (Vulnerable code not present, introduced in 3.4.0)
+	[bullseye] - openexr <not-affected> (Vulnerable code not present, introduced in 3.4.0)
+	NOTE: https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3j9c-j7c9-x293
+	NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/c7af2d233b7b2a4452c11f26cf47584cc2b35721 (v3.4.13-rc)
+	NOTE: Introduced by: https://github.com/AcademySoftwareFoundation/openexr/commit/50ba96b1dbe353a98a626c7fd0ff1e50cc8c188f (v3.4-alpha)
 CVE-2026-65633 (Improper Authentication vulnerability in team-alembic AshAuthenticatio ...)
 	NOT-FOR-US: team-alembic AshAuthentication
 CVE-2026-64204 (There is a memory corruption vulnerability recently discovered in NI L ...)
@@ -301,11 +307,16 @@ CVE-2026-62986 (OpenEXR is the reference implementation and specification for th
 	NOTE: Introduced by: https://github.com/AcademySoftwareFoundation/openexr/commit/84d7d52e17a17e18d138d9d1aa9f4e2de2fcb2d6 (v3.3.0-rc)
 CVE-2026-61555 (OpenEXR is the reference implementation and specification for the EXR  ...)
 	- openexr 3.4.14-0.1
+	[trixie] - openexr <no-dsa> (Minor issue)
 	NOTE: https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-g8f2-r72m-48vx
 	NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/6c6bc2d485f1435d3776b3b4a36f1617cf87070b (v3.4.14-rc)
 	NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/c6d3796918f8e358c9c329e909fa6b0dd7dc8cb9 (v3.2.11-rc)
 CVE-2026-59985 (OpenEXR is the reference implementation and specification for the EXR  ...)
-	TODO: check
+	- openexr 3.4.14-0.1
+	[trixie] - openexr <no-dsa> (Minor issue)
+	NOTE: https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-v6v5-344m-64vm
+	NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/b78496b324832e7cb1ff6b64373a3fe1cfa84e70 (main)
+	NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/7cfa06bf0fd9e89bdda0f75f2920befcaf952616 (v3.2.11-rc)
 CVE-2026-59984 (OpenEXR is the reference implementation and specification for the EXR  ...)
 	TODO: check
 CVE-2026-59983 (OpenEXR is the reference implementation and specification for the EXR  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7b093e5554c62c8fa453a7fdc69b48b3c094cf8c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7b093e5554c62c8fa453a7fdc69b48b3c094cf8c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260825/4cba5abf/attachment.htm>