Security update for openexr SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1292-1 Final 1 1 2020-05-18T05:37:49Z current 2020-05-18T05:37:49Z 2020-05-18T05:37:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openexr This update for openexr provides the following fix: Security issues fixed: - CVE-2020-11764: Fixed an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp (bsc#1169574). - CVE-2020-11763: Fixed an out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp (bsc#1169576). - CVE-2020-11758: Fixed an out-of-bounds read in ImfOptimizedPixelReading.h (bsc#1169573). - CVE-2020-11760: Fixed an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp (bsc#1169580). Non-security issue fixed: - Enable tests when building the package on x86_64. (bsc#1146648) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1292,SUSE-SLE-SDK-12-SP4-2020-1292,SUSE-SLE-SDK-12-SP5-2020-1292,SUSE-SLE-SERVER-12-SP4-2020-1292,SUSE-SLE-SERVER-12-SP5-2020-1292,SUSE-SLE-WE-12-SP4-2020-1292,SUSE-SLE-WE-12-SP5-2020-1292 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201292-1/ Link for SUSE-SU-2020:1292-1 https://lists.suse.com/pipermail/sle-security-updates/2020-May/006828.html E-Mail link for SUSE-SU-2020:1292-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1146648 SUSE Bug 1146648 https://bugzilla.suse.com/1169573 SUSE Bug 1169573 https://bugzilla.suse.com/1169574 SUSE Bug 1169574 https://bugzilla.suse.com/1169576 SUSE Bug 1169576 https://bugzilla.suse.com/1169580 SUSE Bug 1169580 https://www.suse.com/security/cve/CVE-2020-11758/ SUSE CVE CVE-2020-11758 page https://www.suse.com/security/cve/CVE-2020-11760/ SUSE CVE CVE-2020-11760 page https://www.suse.com/security/cve/CVE-2020-11763/ SUSE CVE CVE-2020-11763 page https://www.suse.com/security/cve/CVE-2020-11764/ SUSE CVE CVE-2020-11764 page SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP4 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP4 SUSE Linux Enterprise Workstation Extension 12 SP5 libIlmImf-Imf_2_1-21-2.1.0-6.20.1 libIlmImf-Imf_2_1-21-32bit-2.1.0-6.20.1 libIlmImf-Imf_2_1-21-64bit-2.1.0-6.20.1 openexr-2.1.0-6.20.1 openexr-devel-2.1.0-6.20.1 openexr-doc-2.1.0-6.20.1 libIlmImf-Imf_2_1-21-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Server 12 SP4 openexr-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Server 12 SP4 libIlmImf-Imf_2_1-21-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Server 12 SP5 openexr-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Server 12 SP5 libIlmImf-Imf_2_1-21-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 openexr-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libIlmImf-Imf_2_1-21-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 openexr-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 openexr-devel-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP4 openexr-devel-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libIlmImf-Imf_2_1-21-32bit-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP4 libIlmImf-Imf_2_1-21-32bit-2.1.0-6.20.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read in ImfOptimizedPixelReading.h. CVE-2020-11758 SUSE Linux Enterprise Server 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP4:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP5:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:openexr-devel-2.1.0-6.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:openexr-devel-2.1.0-6.20.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.20.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201292-1/ https://www.suse.com/security/cve/CVE-2020-11758.html CVE-2020-11758 https://bugzilla.suse.com/1169549 SUSE Bug 1169549 https://bugzilla.suse.com/1169573 SUSE Bug 1169573 https://bugzilla.suse.com/1169574 SUSE Bug 1169574 An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp. CVE-2020-11760 SUSE Linux Enterprise Server 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP4:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP5:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:openexr-devel-2.1.0-6.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:openexr-devel-2.1.0-6.20.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.20.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201292-1/ https://www.suse.com/security/cve/CVE-2020-11760.html CVE-2020-11760 https://bugzilla.suse.com/1169580 SUSE Bug 1169580 An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp. CVE-2020-11763 SUSE Linux Enterprise Server 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP4:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP5:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:openexr-devel-2.1.0-6.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:openexr-devel-2.1.0-6.20.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.20.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201292-1/ https://www.suse.com/security/cve/CVE-2020-11763.html CVE-2020-11763 https://bugzilla.suse.com/1169576 SUSE Bug 1169576 An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp. CVE-2020-11764 SUSE Linux Enterprise Server 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP4:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server 12 SP5:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.20.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openexr-2.1.0-6.20.1 SUSE Linux Enterprise Software Development Kit 12 SP4:openexr-devel-2.1.0-6.20.1 SUSE Linux Enterprise Software Development Kit 12 SP5:openexr-devel-2.1.0-6.20.1 SUSE Linux Enterprise Workstation Extension 12 SP4:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.20.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.20.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201292-1/ https://www.suse.com/security/cve/CVE-2020-11764.html CVE-2020-11764 https://bugzilla.suse.com/1169574 SUSE Bug 1169574