[ubuntu/groovy-updates] openexr 2.5.3-2ubuntu0.2 (Accepted)

[Ubuntu Archive Robot]

openexr (2.5.3-2ubuntu0.2) groovy-security; urgency=medium


  * SECURITY UPDATE: shift overflow in FastHufDecoder
    - debian/patches/CVE-2021-3474.patch: compute Huf codelengths using 64
      bit to prevent shift overflow in OpenEXR/IlmImf/ImfFastHuf.cpp.
    - CVE-2021-3474
  * SECURITY UPDATE: integer overflow in calculateNumTiles
    - debian/patches/CVE-2021-3475.patch: compute level size with 64 bits
      to avoid overflow in OpenEXR/IlmImf/ImfTiledMisc.cpp.
    - CVE-2021-3475
  * SECURITY UPDATE: shift overflows
    - debian/patches/CVE-2021-3476.patch: ignore unused bits in B44 mode
      detection in OpenEXR/IlmImf/ImfB44Compressor.cpp.
    - CVE-2021-3476
  * SECURITY UPDATE: out-of-bounds read via deep tile sample size
    - debian/patches/CVE-2021-3477.patch: fix overflow computing deeptile
      sample table size in OpenEXR/IlmImf/ImfDeepTiledInputFile.cpp.
    - CVE-2021-3477
  * SECURITY UPDATE: memory consumption via input file
    - debian/patches/CVE-2021-3478-pre1.patch: reduce size limit for
      scanline files; prevent large chunkoffset allocations in
      OpenEXR/IlmImf/ImfCompressor.cpp, OpenEXR/IlmImf/ImfCompressor.h,
      OpenEXR/IlmImf/ImfMisc.cpp, OpenEXR/IlmImf/ImfMisc.h,
      OpenEXR/IlmImf/ImfMultiPartInputFile.cpp,
      OpenEXR/IlmImf/ImfScanLineInputFile.cpp.
    - debian/patches/CVE-2021-3478.patch: sanity check ScanlineInput
      bytesPerLine instead of lineOffset size in
      OpenEXR/IlmImf/ImfScanLineInputFile.cpp.
    - CVE-2021-3478
  * SECURITY UPDATE: memory consumption in scanline API
    - debian/patches/CVE-2021-3479-pre1.patch: address issues reported by
      Undefined Behavior Sanitizer in OpenEXR/IlmImf/ImfInputFile.cpp.
    - debian/patches/CVE-2021-3479.patch: more efficient handling of filled
      channels reading tiles with scanline API in
      OpenEXR/IlmImf/ImfInputFile.cpp,
      OpenEXR/IlmImfTest/testScanLineApi.cpp.
    - CVE-2021-3479

Date: 2021-04-01 13:44:12.223696+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/openexr/2.5.3-2ubuntu0.2
-------------- next part --------------
Sorry, changesfile not available.