Patch release that addresses several bugs, primarily involving properly rejecting corrupt input data.
Specifically:
- Buffer overflow in PyOpenEXR_old's
channels()andchannel()in legacy python, reported by Joshua Rogers (GitHub: MegaManSec). - Use after free in PyObject_StealAttrString in legacy python, reported by Joshua Rogers (GitHub: MegaManSec).
- Use of Uninitialized Memory in openexr, reported by Aldo Ristori (GitHub: Kaldreic).
- Heap-based Buffer Overflow Remote Code Execution Vulnerability, reported by Trend Micro Zero Day Initiative.
Full changelog: v3.3.5..v3.3.6