git: 2dc02c78e293 - main - security/vuxml: Document security/openexr < 3.4.14 multiple vulnerabilities
Yusuf Yaman <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.cvs.ports |
|---|---|
| Message-ID | <[email protected]> |
The branch main has been updated by nxjoseph: URL: https://cgit.FreeBSD.org/ports/commit/?id=2dc02c78e293e5330d7460047666bc7bfd370e1c commit 2dc02c78e293e5330d7460047666bc7bfd370e1c Author: Yusuf Yaman <[email protected]> AuthorDate: 2026-08-14 10:06:02 +0000 Commit: Yusuf Yaman <[email protected]> CommitDate: 2026-08-14 10:07:56 +0000 security/vuxml: Document security/openexr < 3.4.14 multiple vulnerabilities PR: 297486 Reported by: mandree Approved by: osa, vvd (Mentors, implicit) --- security/vuxml/vuln/2026.xml | 57 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/security/vuxml/vuln/2026.xml b/security/vuxml/vuln/2026.xml index 644e7adea93a..468e15d792f1 100644 --- a/security/vuxml/vuln/2026.xml +++ b/security/vuxml/vuln/2026.xml @@ -1,3 +1,60 @@ + <vuln vid="56449320-97c5-11f1-84d7-3c7c3fba4204"> + <topic>OpenEXR -- 3.4.14 fixes multiple vulnerabilities</topic> + <affects> + <package> + <name>openexr</name> + <range><lt>3.4.14</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Cary Phillips reports:</p> + <blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14"> + <p>[The OpenEXR 3.4.14] release addresses the following security vulnerabilities:</p> + <ul> + <li>CVE-2026-68514: PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow</li> + <li>CVE-2026-68513: PyOpenEXR prefixed literal RGB key collision heap buffer overflow</li> + <li>CVE-2026-62986: PyOpenEXR deep prefixed RGB stale lane disclosure</li> + <li>CVE-2026-61703: PyOpenEXR deep mixed RGB heap buffer overflow</li> + <li>CVE-2026-61555: empty multiView viewFromChannelName file crash</li> + <li>CVE-2026-59985: ILP32 OpenEXRCore RLE decode heap OOB read DoS</li> + <li>CVE-2026-59984: ILP32 B44 InputFile decode scratch buffer overflow</li> + <li>CVE-2026-59983: ILP32 DeepTiledInputFile sample count table decode OOB read</li> + <li>CVE-2026-59982: ILP32 DWAA InputFile packed AC buffer overflow</li> + <li>CVE-2026-59981: OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read</li> + <li>CVE-2026-59189: OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read</li> + <li>CVE-2026-59187: OpenEXR exrmetrics deep pixelmode heap buffer overflow</li> + <li>CVE-2026-59186: OpenEXR ILP32 TiledRgbaInputFile large tile Array2D heap OOB write</li> + <li>CVE-2026-59184: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write</li> + <li>CVE-2026-59183: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2026-68514</cvename> + <cvename>CVE-2026-68513</cvename> + <cvename>CVE-2026-62986</cvename> + <cvename>CVE-2026-61703</cvename> + <cvename>CVE-2026-61555</cvename> + <cvename>CVE-2026-59985</cvename> + <cvename>CVE-2026-59984</cvename> + <cvename>CVE-2026-59983</cvename> + <cvename>CVE-2026-59982</cvename> + <cvename>CVE-2026-59981</cvename> + <cvename>CVE-2026-59189</cvename> + <cvename>CVE-2026-59187</cvename> + <cvename>CVE-2026-59186</cvename> + <cvename>CVE-2026-59184</cvename> + <cvename>CVE-2026-59183</cvename> + <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.14</url> + </references> + <dates> + <discovery>2026-08-07</discovery> + <entry>2026-08-14</entry> + </dates> + </vuln> + <vuln vid="2c73b6d5-971c-11f1-bdc8-2cf05da270f3"> <topic>Gitlab -- vulnerabilities</topic> <affects>