Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 can return an out-of-bounds pointer from TypedDeepImageChannel::row() when a crafted deep EXR has a nonzero dataWindow origin. This vulnerability occurs because the API combines zero-based row access with an absolute-coordinate-adjusted base pointer, allowing a crash or limited information disclosure. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14.
I’ve tried backporting some fixes from OpenEXR upstream in the past, but the CVE’s keep piling up, and downstream backporting of dozens of patches is not sustainable. The vendored OpenEXR has been updated upstream in https://github.com/PixarAnimationStudios/OpenUSD/commit/8ca068a2d06ef84a534776ac7b97973e00f6be7a, fixing dozens of CVE’s. This change isn’t a good candidate for backporting, but it should be present in the next upstream release, which will be ABI-incompatibile and therefore won’t be shipped in stable releases.