AcademySoftwareFoundation/openexr v3.4.17

on GitHub

Patch release that addresses the following security vulnerabilities:

• CVE Pending (GHSA-WHF5-29MJ-GP53) Heap Out-of-Bounds Write via Signed Integer Overflow in DWAA/DWAB LossyDctDecoder
• CVE Pending (GHSA-VP77-HHRC-M2C3) Subsampled chunk-height miscount: heap overflow in B44 encoder, NULL dereference in DWA decoder/encoder
• CVE Pending (GHSA-RXWG-X3WX-PGFH) Heap out-of-bounds write via 32-bit tile-area integer overflow in DeepTiledOutputFile (deep-image re-save path) — possible incomplete fix of PR #939
• CVE Pending (GHSA-RJG8-982X-JHC2) Uninitialized Heap Memory Disclosure in DWA Decompression via Short zlib Stream Mapped to Success
• CVE Pending (GHSA-J76P-H7GW-VMPF) Heap buffer overflow in the OpenEXR Python bindings when two RGB channel groups coalesce to the same key
• CVE Pending (GHSA-G248-596F-9995) Unvalidated extra chlist header attributes merged into Header::channels() cause a heap overflow in run_fill
• CVE Pending (GHSA-FRX8-5P4H-J8M7) Heap OOB Write via Integer Overflow in B44 Chunk Unpacked-Size Computation — Remote Code Execution in OpenEXRCore
• CVE Pending (GHSA-638X-X7MR-89XC) Out-of-bounds write at an attacker-chosen displacement in legacy Python InputFile.channel()
• CVE Pending (GHSA-3CP4-779M-H837) Use-after-free in OpenEXRCore exr_copy_unset_attributes() when a channel name exceeds 31 bytes

This version also addresses a regression introduced in v3.4.14 in reading deep images on big-endian hosts, due to a byte-order bug in the deep sample count table. Little-endian hosts are unaffected.

See CHANGES.md for more details.

Contributors