Security update for openexr SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:2913-1 Final 1 1 2021-09-02T07:53:43Z current 2021-09-02T07:53:43Z 2021-09-02T07:53:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openexr This update for openexr fixes the following issues: - CVE-2021-20298 [bsc#1188460]: Fixed Out-of-memory in B44Compressor - CVE-2021-20299 [bsc#1188459]: Fixed Null-dereference READ in Imf_2_5:Header:operator - CVE-2021-20300 [bsc#1188458]: Fixed Integer-overflow in Imf_2_5:hufUncompress - CVE-2021-20302 [bsc#1188462]: Fixed Floating-point-exception in Imf_2_5:precalculateTileInfot - CVE-2021-20303 [bsc#1188457]: Fixed Heap-buffer-overflow in Imf_2_5::copyIntoFrameBuffer - CVE-2021-20304 [bsc#1188461]: Fixed Undefined-shift in Imf_2_5:hufDecode The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). HPE-Helion-OpenStack-8-2021-2913,SUSE-2021-2913,SUSE-OpenStack-Cloud-8-2021-2913,SUSE-OpenStack-Cloud-9-2021-2913,SUSE-OpenStack-Cloud-Crowbar-8-2021-2913,SUSE-OpenStack-Cloud-Crowbar-9-2021-2913,SUSE-SLE-SAP-12-SP3-2021-2913,SUSE-SLE-SAP-12-SP4-2021-2913,SUSE-SLE-SDK-12-SP5-2021-2913,SUSE-SLE-SERVER-12-SP2-BCL-2021-2913,SUSE-SLE-SERVER-12-SP3-2021-2913,SUSE-SLE-SERVER-12-SP3-BCL-2021-2913,SUSE-SLE-SERVER-12-SP4-LTSS-2021-2913,SUSE-SLE-SERVER-12-SP5-2021-2913,SUSE-SLE-WE-12-SP5-2021-2913 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20212913-1/ Link for SUSE-SU-2021:2913-1 https://lists.suse.com/pipermail/sle-security-updates/2021-September/009386.html E-Mail link for SUSE-SU-2021:2913-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188457 SUSE Bug 1188457 https://bugzilla.suse.com/1188458 SUSE Bug 1188458 https://bugzilla.suse.com/1188459 SUSE Bug 1188459 https://bugzilla.suse.com/1188460 SUSE Bug 1188460 https://bugzilla.suse.com/1188461 SUSE Bug 1188461 https://bugzilla.suse.com/1188462 SUSE Bug 1188462 https://www.suse.com/security/cve/CVE-2021-20298/ SUSE CVE CVE-2021-20298 page https://www.suse.com/security/cve/CVE-2021-20299/ SUSE CVE CVE-2021-20299 page https://www.suse.com/security/cve/CVE-2021-20300/ SUSE CVE CVE-2021-20300 page https://www.suse.com/security/cve/CVE-2021-20302/ SUSE CVE CVE-2021-20302 page https://www.suse.com/security/cve/CVE-2021-20303/ SUSE CVE CVE-2021-20303 page https://www.suse.com/security/cve/CVE-2021-20304/ SUSE CVE CVE-2021-20304 page https://www.suse.com/security/cve/CVE-2021-3476/ SUSE CVE CVE-2021-3476 page HPE Helion OpenStack 8 SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP3-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE Linux Enterprise Workstation Extension 12 SP5 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 libIlmImf-Imf_2_1-21-2.1.0-6.37.1 openexr-2.1.0-6.37.1 libIlmImf-Imf_2_1-21-32bit-2.1.0-6.37.1 libIlmImf-Imf_2_1-21-64bit-2.1.0-6.37.1 openexr-devel-2.1.0-6.37.1 openexr-doc-2.1.0-6.37.1 libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of HPE Helion OpenStack 8 openexr-2.1.0-6.37.1 as a component of HPE Helion OpenStack 8 libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL openexr-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL openexr-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS openexr-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server 12 SP3-LTSS libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS openexr-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server 12 SP5 openexr-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server 12 SP5 libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 openexr-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 openexr-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 openexr-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 openexr-devel-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libIlmImf-Imf_2_1-21-32bit-2.1.0-6.37.1 as a component of SUSE Linux Enterprise Workstation Extension 12 SP5 libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE OpenStack Cloud 8 openexr-2.1.0-6.37.1 as a component of SUSE OpenStack Cloud 8 libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE OpenStack Cloud 9 openexr-2.1.0-6.37.1 as a component of SUSE OpenStack Cloud 9 libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE OpenStack Cloud Crowbar 8 openexr-2.1.0-6.37.1 as a component of SUSE OpenStack Cloud Crowbar 8 libIlmImf-Imf_2_1-21-2.1.0-6.37.1 as a component of SUSE OpenStack Cloud Crowbar 9 openexr-2.1.0-6.37.1 as a component of SUSE OpenStack Cloud Crowbar 9 A flaw was found in OpenEXR's B44Compressor. This flaw allows an attacker who can submit a crafted file to be processed by OpenEXR, to exhaust all memory accessible to the application. The highest threat from this vulnerability is to system availability. CVE-2021-20298 HPE Helion OpenStack 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 HPE Helion OpenStack 8:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Software Development Kit 12 SP5:openexr-devel-2.1.0-6.37.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.37.1 SUSE OpenStack Cloud 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 9:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:openexr-2.1.0-6.37.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212913-1/ https://www.suse.com/security/cve/CVE-2021-20298.html CVE-2021-20298 https://bugzilla.suse.com/1188460 SUSE Bug 1188460 https://bugzilla.suse.com/1191176 SUSE Bug 1191176 A flaw was found in OpenEXR's Multipart input file functionality. A crafted multi-part input file with no actual parts can trigger a NULL pointer dereference. The highest threat from this vulnerability is to system availability. CVE-2021-20299 HPE Helion OpenStack 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 HPE Helion OpenStack 8:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Software Development Kit 12 SP5:openexr-devel-2.1.0-6.37.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.37.1 SUSE OpenStack Cloud 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 9:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:openexr-2.1.0-6.37.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212913-1/ https://www.suse.com/security/cve/CVE-2021-20299.html CVE-2021-20299 https://bugzilla.suse.com/1188459 SUSE Bug 1188459 https://bugzilla.suse.com/1191176 SUSE Bug 1191176 A flaw was found in OpenEXR's hufUncompress functionality in OpenEXR/IlmImf/ImfHuf.cpp. This flaw allows an attacker who can submit a crafted file that is processed by OpenEXR, to trigger an integer overflow. The highest threat from this vulnerability is to system availability. CVE-2021-20300 HPE Helion OpenStack 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 HPE Helion OpenStack 8:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Software Development Kit 12 SP5:openexr-devel-2.1.0-6.37.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.37.1 SUSE OpenStack Cloud 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 9:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:openexr-2.1.0-6.37.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212913-1/ https://www.suse.com/security/cve/CVE-2021-20300.html CVE-2021-20300 https://bugzilla.suse.com/1188458 SUSE Bug 1188458 https://bugzilla.suse.com/1191176 SUSE Bug 1191176 A flaw was found in OpenEXR's TiledInputFile functionality. This flaw allows an attacker who can submit a crafted single-part non-image to be processed by OpenEXR, to trigger a floating-point exception error. The highest threat from this vulnerability is to system availability. CVE-2021-20302 HPE Helion OpenStack 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 HPE Helion OpenStack 8:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Software Development Kit 12 SP5:openexr-devel-2.1.0-6.37.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.37.1 SUSE OpenStack Cloud 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 9:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:openexr-2.1.0-6.37.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212913-1/ https://www.suse.com/security/cve/CVE-2021-20302.html CVE-2021-20302 https://bugzilla.suse.com/1188462 SUSE Bug 1188462 https://bugzilla.suse.com/1191176 SUSE Bug 1191176 A flaw found in function dataWindowForTile() of IlmImf/ImfTiledMisc.cpp. An attacker who is able to submit a crafted file to be processed by OpenEXR could trigger an integer overflow, leading to an out-of-bounds write on the heap. The greatest impact of this flaw is to application availability, with some potential impact to data integrity as well. CVE-2021-20303 HPE Helion OpenStack 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 HPE Helion OpenStack 8:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Software Development Kit 12 SP5:openexr-devel-2.1.0-6.37.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.37.1 SUSE OpenStack Cloud 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 9:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:openexr-2.1.0-6.37.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212913-1/ https://www.suse.com/security/cve/CVE-2021-20303.html CVE-2021-20303 https://bugzilla.suse.com/1188457 SUSE Bug 1188457 https://bugzilla.suse.com/1191176 SUSE Bug 1191176 A flaw was found in OpenEXR's hufDecode functionality. This flaw allows an attacker who can pass a crafted file to be processed by OpenEXR, to trigger an undefined right shift error. The highest threat from this vulnerability is to system availability. CVE-2021-20304 HPE Helion OpenStack 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 HPE Helion OpenStack 8:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Software Development Kit 12 SP5:openexr-devel-2.1.0-6.37.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.37.1 SUSE OpenStack Cloud 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 9:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:openexr-2.1.0-6.37.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212913-1/ https://www.suse.com/security/cve/CVE-2021-20304.html CVE-2021-20304 https://bugzilla.suse.com/1188461 SUSE Bug 1188461 https://bugzilla.suse.com/1191176 SUSE Bug 1191176 A flaw was found in OpenEXR's B44 uncompression functionality in versions before 3.0.0-beta. An attacker who is able to submit a crafted file to OpenEXR could trigger shift overflows, potentially affecting application availability. CVE-2021-3476 HPE Helion OpenStack 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 HPE Helion OpenStack 8:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP2-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-BCL:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP3-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openexr-2.1.0-6.37.1 SUSE Linux Enterprise Software Development Kit 12 SP5:openexr-devel-2.1.0-6.37.1 SUSE Linux Enterprise Workstation Extension 12 SP5:libIlmImf-Imf_2_1-21-32bit-2.1.0-6.37.1 SUSE OpenStack Cloud 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud 9:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 8:openexr-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:libIlmImf-Imf_2_1-21-2.1.0-6.37.1 SUSE OpenStack Cloud Crowbar 9:openexr-2.1.0-6.37.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212913-1/ https://www.suse.com/security/cve/CVE-2021-3476.html CVE-2021-3476 https://bugzilla.suse.com/1184172 SUSE Bug 1184172