Bug 30390 - openexr possible new security issues rhbz#2077539, rhbz#2077540, rhbz#2077546, rhbz#2077549
Summary: openexr possible new security issues rhbz#2077539, rhbz#2077540, rhbz#2077546...
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: All Packagers
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-05-07 21:29 CEST by David Walser
Modified: 2024-01-12 09:50 CET (History)
2 users (show)

See Also:
Source RPM: openexr-2.5.7-1.3.mga8.src.rpm
CVE:
Status comment: Fixed upstream in 3.1.5

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2022-05-07 21:29:50 CEST 
Fedora has issued an advisory today (May 7):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/BIGOY2HN5ESENKKD7CAJ6WXXTRPRN47Q/

The issues are fixed upstream in 3.1.5 (already in Cauldron).
David Walser 2022-05-07 21:30:08 CEST

CC: (none) => nicolas.salguero
Status comment: (none) => Fixed upstream in 3.1.5

Comment 1 Lewis Smith 2022-05-09 21:51:27 CEST 
This package is formally with ghibo, but NicolasS has done most recent updates, so assigning to you; CC'ing Giuseppe in hope.

3.1.5 (already in Cauldron) - thanks to luigi.

CC: nicolas.salguero => ghibomgx
Assignee: bugsquad => nicolas.salguero

Comment 2 Giuseppe Ghibò 2022-05-09 23:08:05 CEST 
Indeed you are problably referring to openxr, which is not the same as openexr (OpenEXR). Anyway this package has a long list of dependency so upgrading to 3.1.x would probably break and need to recompile other dep packages. I looked at the github site and seems there is a version 2.5.8 with latest commits to march 2022, but haven't checked whether those include the security fixes.
Comment 3 Giuseppe Ghibò 2022-05-09 23:09:49 CEST 
s/problably/probably/
Nicolas Salguero 2022-11-03 13:56:22 CET

Assignee: nicolas.salguero => pkg-bugs

Comment 4 Nicolas Salguero 2024-01-12 09:50:49 CET 
Mageia 8 EOL

CC: (none) => nicolas.salguero
Status: NEW => RESOLVED
Resolution: (none) => OLD
Note You need to log in before you can comment on or make changes to this bug.