Re: git: 43e43009bbb0 - main - graphics/openexr*: Security update 3.4.13 => 3.4.14

Hi Jochen,

Thank you, I've just wish I didn't make that typo in there. :/

On 8/14/26 13:09, Jochen Neumeister wrote:
>
>
> Am 14.08.26 um 12:07 schrieb Jochen Neumeister:
>>
>>
>> Am 14.08.26 um 12:01 schrieb Yusuf Yaman:
>>> The branch main has been updated by nxjoseph:
>>>
>>> URL: https://cgit.FreeBSD.org/ports/commit/? 
>>> id=43e43009bbb057f5dbcd4351a7172e6fe4a2d7c1
>>>
>>> commit 43e43009bbb057f5dbcd4351a7172e6fe4a2d7c1
>>> Author:     Matthias Andree <[email protected]>
>>> AuthorDate: 2026-08-12 21:00:34 +0000
>>> Commit:     Yusuf Yaman <[email protected]>
>>> CommitDate: 2026-08-14 10:00:35 +0000
>>>
>>>      graphics/openexr*: Security update 3.4.13 => 3.4.14
>>>      Changelog:
>>> https://github.com/AcademySoftwareFoundation/openexr/releases/ 
>>> tag/v3.4.14
>>>      PR:             297486
>>>      Reported by:    mandree (maintainer)
>>>      Approved by:    osa, vvd (Mentors, implicit)
>>>      Pull Request: https://github.com/freebsd/freebsd-ports/pull/580
>>>      MFH:            2026Q3
>>>      Security:       CVE-2026-68514 PyOpenEXR deep prefixed literal 
>>> RGB key collision heap buffer overflow
>>>      Security:       CVE-2026-68513 PyOpenEXR prefixed literal RGB 
>>> key collision heap buffer overflow
>>>      Security:       CVE-2026-62986 PyOpenEXR deep prefixed RGB 
>>> stale lane disclosure
>>>      Security:       CVE-2026-61703 PyOpenEXR deep mixed RGB heap 
>>> buffer overflow
>>>      Security:       CVE-2026-61555 empty multiView 
>>> viewFromChannelName file crash
>>>      Security:       CVE-2026-59985 ILP32 OpenEXRCore RLE decode 
>>> heap OOB read DoS
>>>      Security:       CVE-2026-59984 ILP32 B44 InputFile decode 
>>> scratch buffer overflow
>>>      Security:       CVE-2026-59983 ILP32 DeepTiledInputFile sample 
>>> count table decode OOB read
>>>      Security:       CVE-2026-59982 ILP32 DWAA InputFile packed AC 
>>> buffer overflow
>>>      Security:       CVE-2026-59981 OpenEXRUtil SampleCountChannel 
>>> row nonzero dataWindow heap OOB read
>>>      Security:       CVE-2026-59189 OpenEXRUtil DeepImageChannel row 
>>> nonzero dataWindow heap OOB read
>>>      Security:       CVE-2026-59187 OpenEXR exrmetrics deep 
>>> pixelmode heap buffer overflow
>>>      Security:       CVE-2026-59186 OpenEXR ILP32 TiledRgbaInputFile 
>>> large tile Array2D heap OOB write
>>>      Security:       CVE-2026-59184 OpenEXRUtil FlatImageChannel row 
>>> nonzero dataWindow heap OOB write
>>>      Security:       CVE-2026-59183 Signed Integer Overflow Leading 
>>> to Out-of-Bounds Memory Access in Deep Tile Decoding
>>
>> Hi Yusuf,
>> Could you please create a VUXML entry for the CVEs?
>
> I’ve just noticed that this has already been sorted.
> Thank you very much – that means my comment is no longer needed :)
>
> Thank you,
> Jochen
>
>>
>>> ---
>>>   graphics/openexr-website-docs/Makefile | 4 ++--
>>>   graphics/openexr-website-docs/distinfo | 6 +++---
>>>   graphics/openexr/Makefile              | 4 ++--
>>>   graphics/openexr/distinfo              | 6 +++---
>>>   4 files changed, 10 insertions(+), 10 deletions(-)
>>>
>>> diff --git a/graphics/openexr-website-docs/Makefile b/graphics/ 
>>> openexr-website-docs/Makefile
>>> index 657306441279..78e8d6596b04 100644
>>> --- a/graphics/openexr-website-docs/Makefile
>>> +++ b/graphics/openexr-website-docs/Makefile
>>> @@ -1,6 +1,6 @@
>>>   PORTNAME=    openexr-website-docs
>>> -DISTVERSION=    3.4.13
>>> -PORTREVISION=    1
>>> +DISTVERSION=    3.4.14
>>> +PORTREVISION=    0
>>>   MASTER_SITES= https://github.com/AcademySoftwareFoundation/ 
>>> openexr/releases/download/v${DISTVERSION}/:DEFAULT \
>>> https://raw.githubusercontent.com/AcademySoftwareFoundation/ 
>>> openexr-images/main/:website \
>>>           LOCAL/mandree/openexr/:DEFAULT \
>>> diff --git a/graphics/openexr-website-docs/distinfo b/graphics/ 
>>> openexr-website-docs/distinfo
>>> index db33838445c0..855c17ef64b4 100644
>>> --- a/graphics/openexr-website-docs/distinfo
>>> +++ b/graphics/openexr-website-docs/distinfo
>>> @@ -1,6 +1,6 @@
>>> -TIMESTAMP = 1781941135
>>> -SHA256 (openexr/openexr-3.4.13.tar.gz) = 
>>> fe99c9cf06e41803db75ae4f5c9bb9955b7033ff47f05b02bc60bc5dba391996
>>> -SIZE (openexr/openexr-3.4.13.tar.gz) = 25783727
>>> +TIMESTAMP = 1786564614
>>> +SHA256 (openexr/openexr-3.4.14.tar.gz) = 
>>> 174d0d711d963c46eaa7cd2669d6cb1ea52579f43aa2726892f0b9554339ba6b
>>> +SIZE (openexr/openexr-3.4.14.tar.gz) = 25838337
>>>   SHA256 (openexr/TestImages/README.rst) = 
>>> 3cbb0a9ab20868940de1b9bf582bdc5ff4244cc585c682d6e40b9befb8fd593c
>>>   SIZE (openexr/TestImages/README.rst) = 2588
>>>   SHA256 (openexr/TestImages/AllHalfValues.exr) = 
>>> eede573a0b59b79f21de15ee9d3b7649d58d8f2a8e7787ea34f192db3b3c84a4
>>> diff --git a/graphics/openexr/Makefile b/graphics/openexr/Makefile
>>> index 1edbd73d8b99..6bd140152101 100644
>>> --- a/graphics/openexr/Makefile
>>> +++ b/graphics/openexr/Makefile
>>> @@ -1,6 +1,6 @@
>>>   PORTNAME?=    openexr
>>> -DISTVERSION?=    3.4.13 # ALSO update openexr-website-docs! -- 
>>> verify sigstore: make makesum verify-sigstore
>>> -PORTREVISION?=    1
>>> +DISTVERSION?=    3.4.14 # ALSO update openexr-website-docs! -- 
>>> verify sigstore: make makesum verify-sigstore
>>> +PORTREVISION?=    0
>>>   CATEGORIES=    graphics devel
>>>   .if !defined(MASTERDIR)
>>>   MASTER_SITES=    https://raw.githubusercontent.com/ 
>>> AcademySoftwareFoundation/openexr-images/v1.0/:testimages \
>>> diff --git a/graphics/openexr/distinfo b/graphics/openexr/distinfo
>>> index ac693ad8e30e..ea52f36bb781 100644
>>> --- a/graphics/openexr/distinfo
>>> +++ b/graphics/openexr/distinfo
>>> @@ -1,6 +1,6 @@
>>> -TIMESTAMP = 1781941135
>>> -SHA256 (openexr/openexr-3.4.13.tar.gz) = 
>>> fe99c9cf06e41803db75ae4f5c9bb9955b7033ff47f05b02bc60bc5dba391996
>>> -SIZE (openexr/openexr-3.4.13.tar.gz) = 25783727
>>> +TIMESTAMP = 1786562953
>>> +SHA256 (openexr/openexr-3.4.14.tar.gz) = 
>>> 174d0d711d963c46eaa7cd2669d6cb1ea52579f43aa2726892f0b9554339ba6b
>>> +SIZE (openexr/openexr-3.4.14.tar.gz) = 25838337
>>>   SHA256 (openexr/Beachball/multipart.0001.exr) = 
>>> 0cd032069fbaa14a2766861fef9893ea66a6494ff64650725d3b26a500df774b
>>>   SIZE (openexr/Beachball/multipart.0001.exr) = 2894260
>>>   SHA256 (openexr/Beachball/singlepart.0001.exr) = 
>>> 29719942ed3c095a8f8f111fc139fc4c28f446007f5bfce00177cae585b1a87a
>>>
>>>
>>
>>
>>
>
-- 
Yusuf Yaman