Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openexr for openSUSE:Factory checked in at 2026-08-26 19:51:27 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openexr (Old) and /work/SRC/openSUSE:Factory/.openexr.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openexr" Wed Aug 26 19:51:27 2026 rev:82 rq:1373794 version:3.4.14 Changes: -------- --- /work/SRC/openSUSE:Factory/openexr/openexr.changes 2026-07-08 17:36:31.869453503 +0200 +++ /work/SRC/openSUSE:Factory/.openexr.new.1258/openexr.changes 2026-08-26 19:52:16.472671402 +0200 @@ -1,0 +2,52 @@ +Tue Aug 25 06:49:35 UTC 2026 - Petr Gajdos <[email protected]> + +- version update to 3.4.14 + * [CVE-2026-68514](https://www.cve.org/CVERecord?id=CVE-2026-68514) + PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow + * [CVE-2026-68513](https://www.cve.org/CVERecord?id=CVE-2026-68513) + PyOpenEXR prefixed literal RGB key collision heap buffer overflow + * [CVE-2026-62986](https://www.cve.org/CVERecord?id=CVE-2026-62986) + PyOpenEXR deep prefixed RGB stale lane disclosure + * [CVE-2026-61703](https://www.cve.org/CVERecord?id=CVE-2026-61703) + PyOpenEXR deep mixed RGB heap buffer overflow + * [CVE-2026-61555](https://www.cve.org/CVERecord?id=CVE-2026-61555) + empty multiView viewFromChannelName file crash + * [CVE-2026-59985](https://www.cve.org/CVERecord?id=CVE-2026-59985) + ILP32 OpenEXRCore RLE decode heap OOB read DoS + * [CVE-2026-59984](https://www.cve.org/CVERecord?id=CVE-2026-59984) + ILP32 B44 InputFile decode scratch buffer overflow + * [CVE-2026-59983](https://www.cve.org/CVERecord?id=CVE-2026-59983) + ILP32 DeepTiledInputFile sample count table decode OOB read + * [CVE-2026-59982](https://www.cve.org/CVERecord?id=CVE-2026-59982) + ILP32 DWAA InputFile packed AC buffer overflow + * [CVE-2026-59981](https://www.cve.org/CVERecord?id=CVE-2026-59981) + OpenEXRUtil SampleCountChannel row nonzero dataWindow heap OOB read + * [CVE-2026-59189](https://www.cve.org/CVERecord?id=CVE-2026-59189) + OpenEXRUtil DeepImageChannel row nonzero dataWindow heap OOB read + * [CVE-2026-59187](https://www.cve.org/CVERecord?id=CVE-2026-59187) + OpenEXR exrmetrics deep pixelmode heap buffer overflow + * [CVE-2026-59186](https://www.cve.org/CVERecord?id=CVE-2026-59186) + OpenEXR ILP32 TiledRgbaInputFile large tile Array2D heap OOB write + * [CVE-2026-59184](https://www.cve.org/CVERecord?id=CVE-2026-59184) + OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write + * [CVE-2026-59183](https://www.cve.org/CVERecord?id=CVE-2026-59183) + Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile Decoding +- for other changes see CHANGES.md +- fixes CVE-2026-59183 [bsc#1276428] + CVE-2026-65979 [bsc#1276843] + CVE-2026-68513 [bsc#1276845] + CVE-2026-68514 [bsc#1276846] + CVE-2026-68515 [bsc#1276848] + CVE-2026-59184 [bsc#1276849] + CVE-2026-59186 [bsc#1276850] + CVE-2026-59187 [bsc#1276851] + CVE-2026-59982 [bsc#1276853] + CVE-2026-59189 [bsc#1276855] + CVE-2026-59983 [bsc#1276856] + CVE-2026-59984 [bsc#1276857] + CVE-2026-59985 [bsc#1276858] + CVE-2026-61555 [bsc#1276859] + CVE-2026-62986 [bsc#1276861] + CVE-2026-59981 [bsc#1276862] + +------------------------------------------------------------------- Old: ---- v3.4.13.tar.gz New: ---- v3.4.14.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openexr.spec ++++++ --- /var/tmp/diff_new_pack.4KzCZN/_old 2026-08-26 19:52:18.353737838 +0200 +++ /var/tmp/diff_new_pack.4KzCZN/_new 2026-08-26 19:52:18.355737908 +0200 @@ -26,7 +26,7 @@ %endif Name: openexr -Version: 3.4.13 +Version: 3.4.14 Release: 0 Summary: Utilities for working with HDR images in OpenEXR format License: BSD-3-Clause ++++++ v3.4.13.tar.gz -> v3.4.14.tar.gz ++++++ /work/SRC/openSUSE:Factory/openexr/v3.4.13.tar.gz /work/SRC/openSUSE:Factory/.openexr.new.1258/v3.4.14.tar.gz differ: char 13, line 1
