USN-5620-1: OpenEXR vulnerabilities
20 September 2022
Several security issues were fixed in OpenEXR.
Releases
Packages
- openexr - tools for the OpenEXR image format
Details
It was discovered that OpenEXR incorrectly handled certain malformed EXR
image files. If a user were tricked into opening a crafted EXR image file,
a remote attacker could cause a denial of service, or possibly execute
arbitrary code. These issues only affected Ubuntu 20.04 ESM. (CVE-2021-3598,
CVE-2021-3605, CVE-2021-20296, CVE-2021-23215, CVE-2021-26260)
It was discovered that OpenEXR incorrectly handled certain EXR
image files. An attacker could possibly use this issue to cause a crash
or execute arbitrary code. (CVE-2021-3933)
It was discovered that OpenEXR incorrectly handled certain EXR image files.
An attacker could possibly use this issue to cause a crash. (CVE-2021-3941)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.04
-
openexr
-
2.5.7-1ubuntu0.1~esm1
Available with Ubuntu Pro
-
libopenexr25
-
2.5.7-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 20.04
-
openexr
-
2.3.0-6ubuntu0.5+esm1
Available with Ubuntu Pro
-
libopenexr24
-
2.3.0-6ubuntu0.5+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.
Related notices
- USN-4996-1: libopenexr-dev, libopenexr22, openexr-doc, openexr
- USN-4996-2: libopenexr-dev, libopenexr22, openexr-doc, openexr
- USN-5150-1: libopenexr-dev, libopenexr22, openexr-doc, openexr
- USN-5144-1: libopenexr-dev, libopenexr22, openexr-doc, openexr