Re: git: 43e43009bbb0 - main - graphics/openexr*: Security update 3.4.13 => 3.4.14
Jochen Neumeister <[email protected]>
| Newsgroups | gmane.os.freebsd.devel.cvs.ports |
|---|---|
| Message-ID | <[email protected]> |
Am 14.08.26 um 12:07 schrieb Jochen Neumeister: > > > Am 14.08.26 um 12:01 schrieb Yusuf Yaman: >> The branch main has been updated by nxjoseph: >> >> URL: https://cgit.FreeBSD.org/ports/commit/? >> id=43e43009bbb057f5dbcd4351a7172e6fe4a2d7c1 >> >> commit 43e43009bbb057f5dbcd4351a7172e6fe4a2d7c1 >> Author: Matthias Andree <[email protected]> >> AuthorDate: 2026-08-12 21:00:34 +0000 >> Commit: Yusuf Yaman <[email protected]> >> CommitDate: 2026-08-14 10:00:35 +0000 >> >> graphics/openexr*: Security update 3.4.13 => 3.4.14 >> Changelog: >> https://github.com/AcademySoftwareFoundation/openexr/releases/ >> tag/v3.4.14 >> PR: 297486 >> Reported by: mandree (maintainer) >> Approved by: osa, vvd (Mentors, implicit) >> Pull Request: https://github.com/freebsd/freebsd-ports/pull/580 >> MFH: 2026Q3 >> Security: CVE-2026-68514 PyOpenEXR deep prefixed literal >> RGB key collision heap buffer overflow >> Security: CVE-2026-68513 PyOpenEXR prefixed literal RGB key >> collision heap buffer overflow >> Security: CVE-2026-62986 PyOpenEXR deep prefixed RGB stale >> lane disclosure >> Security: CVE-2026-61703 PyOpenEXR deep mixed RGB heap >> buffer overflow >> Security: CVE-2026-61555 empty multiView >> viewFromChannelName file crash >> Security: CVE-2026-59985 ILP32 OpenEXRCore RLE decode heap >> OOB read DoS >> Security: CVE-2026-59984 ILP32 B44 InputFile decode scratch >> buffer overflow >> Security: CVE-2026-59983 ILP32 DeepTiledInputFile sample >> count table decode OOB read >> Security: CVE-2026-59982 ILP32 DWAA InputFile packed AC >> buffer overflow >> Security: CVE-2026-59981 OpenEXRUtil SampleCountChannel row >> nonzero dataWindow heap OOB read >> Security: CVE-2026-59189 OpenEXRUtil DeepImageChannel row >> nonzero dataWindow heap OOB read >> Security: CVE-2026-59187 OpenEXR exrmetrics deep pixelmode >> heap buffer overflow >> Security: CVE-2026-59186 OpenEXR ILP32 TiledRgbaInputFile >> large tile Array2D heap OOB write >> Security: CVE-2026-59184 OpenEXRUtil FlatImageChannel row >> nonzero dataWindow heap OOB write >> Security: CVE-2026-59183 Signed Integer Overflow Leading to >> Out-of-Bounds Memory Access in Deep Tile Decoding > > Hi Yusuf, > Could you please create a VUXML entry for the CVEs? I’ve just noticed that this has already been sorted. Thank you very much – that means my comment is no longer needed :) Thank you, Jochen > >> --- >> graphics/openexr-website-docs/Makefile | 4 ++-- >> graphics/openexr-website-docs/distinfo | 6 +++--- >> graphics/openexr/Makefile | 4 ++-- >> graphics/openexr/distinfo | 6 +++--- >> 4 files changed, 10 insertions(+), 10 deletions(-) >> >> diff --git a/graphics/openexr-website-docs/Makefile b/graphics/ >> openexr-website-docs/Makefile >> index 657306441279..78e8d6596b04 100644 >> --- a/graphics/openexr-website-docs/Makefile >> +++ b/graphics/openexr-website-docs/Makefile >> @@ -1,6 +1,6 @@ >> PORTNAME= openexr-website-docs >> -DISTVERSION= 3.4.13 >> -PORTREVISION= 1 >> +DISTVERSION= 3.4.14 >> +PORTREVISION= 0 >> MASTER_SITES= https://github.com/AcademySoftwareFoundation/ >> openexr/releases/download/v${DISTVERSION}/:DEFAULT \ >> https://raw.githubusercontent.com/AcademySoftwareFoundation/ >> openexr-images/main/:website \ >> LOCAL/mandree/openexr/:DEFAULT \ >> diff --git a/graphics/openexr-website-docs/distinfo b/graphics/ >> openexr-website-docs/distinfo >> index db33838445c0..855c17ef64b4 100644 >> --- a/graphics/openexr-website-docs/distinfo >> +++ b/graphics/openexr-website-docs/distinfo >> @@ -1,6 +1,6 @@ >> -TIMESTAMP = 1781941135 >> -SHA256 (openexr/openexr-3.4.13.tar.gz) = >> fe99c9cf06e41803db75ae4f5c9bb9955b7033ff47f05b02bc60bc5dba391996 >> -SIZE (openexr/openexr-3.4.13.tar.gz) = 25783727 >> +TIMESTAMP = 1786564614 >> +SHA256 (openexr/openexr-3.4.14.tar.gz) = >> 174d0d711d963c46eaa7cd2669d6cb1ea52579f43aa2726892f0b9554339ba6b >> +SIZE (openexr/openexr-3.4.14.tar.gz) = 25838337 >> SHA256 (openexr/TestImages/README.rst) = >> 3cbb0a9ab20868940de1b9bf582bdc5ff4244cc585c682d6e40b9befb8fd593c >> SIZE (openexr/TestImages/README.rst) = 2588 >> SHA256 (openexr/TestImages/AllHalfValues.exr) = >> eede573a0b59b79f21de15ee9d3b7649d58d8f2a8e7787ea34f192db3b3c84a4 >> diff --git a/graphics/openexr/Makefile b/graphics/openexr/Makefile >> index 1edbd73d8b99..6bd140152101 100644 >> --- a/graphics/openexr/Makefile >> +++ b/graphics/openexr/Makefile >> @@ -1,6 +1,6 @@ >> PORTNAME?= openexr >> -DISTVERSION?= 3.4.13 # ALSO update openexr-website-docs! -- verify >> sigstore: make makesum verify-sigstore >> -PORTREVISION?= 1 >> +DISTVERSION?= 3.4.14 # ALSO update openexr-website-docs! -- verify >> sigstore: make makesum verify-sigstore >> +PORTREVISION?= 0 >> CATEGORIES= graphics devel >> .if !defined(MASTERDIR) >> MASTER_SITES= https://raw.githubusercontent.com/ >> AcademySoftwareFoundation/openexr-images/v1.0/:testimages \ >> diff --git a/graphics/openexr/distinfo b/graphics/openexr/distinfo >> index ac693ad8e30e..ea52f36bb781 100644 >> --- a/graphics/openexr/distinfo >> +++ b/graphics/openexr/distinfo >> @@ -1,6 +1,6 @@ >> -TIMESTAMP = 1781941135 >> -SHA256 (openexr/openexr-3.4.13.tar.gz) = >> fe99c9cf06e41803db75ae4f5c9bb9955b7033ff47f05b02bc60bc5dba391996 >> -SIZE (openexr/openexr-3.4.13.tar.gz) = 25783727 >> +TIMESTAMP = 1786562953 >> +SHA256 (openexr/openexr-3.4.14.tar.gz) = >> 174d0d711d963c46eaa7cd2669d6cb1ea52579f43aa2726892f0b9554339ba6b >> +SIZE (openexr/openexr-3.4.14.tar.gz) = 25838337 >> SHA256 (openexr/Beachball/multipart.0001.exr) = >> 0cd032069fbaa14a2766861fef9893ea66a6494ff64650725d3b26a500df774b >> SIZE (openexr/Beachball/multipart.0001.exr) = 2894260 >> SHA256 (openexr/Beachball/singlepart.0001.exr) = >> 29719942ed3c095a8f8f111fc139fc4c28f446007f5bfce00177cae585b1a87a >> >> > > >