Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-OpenEXR for openSUSE:Factory
checked in at 2026-10-18 19:26:40
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-OpenEXR (Old)
and /work/SRC/openSUSE:Factory/.python-OpenEXR.new.3698736 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-OpenEXR"
Sun Oct 18 19:26:40 2026 rev:3 rq:1385988 version:3.4.16
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-OpenEXR/python-OpenEXR.changes
2026-09-29 17:54:10.378213465 +0200
+++
/work/SRC/openSUSE:Factory/.python-OpenEXR.new.3698736/python-OpenEXR.changes
2026-10-18 19:27:16.986697522 +0200
@@ -1,0 +2,26 @@
+Sun Oct 18 05:56:53 UTC 2026 - Martin Pluskal <[email protected]>
+
+- Update to version 3.4.16:
+ * 3.4.16 fixes unreadable DWAB output and BytesAttribute
+ undefined-behavior warnings; 3.4.15 bounds IDManifest parse
+ memory on corrupt or malicious files.
+ * 3.4.14 security release, 17 CVEs via crafted EXR files:
+ * CVE-2026-68516: HTJ2K tile-grid stack OOB write (boo#1276429)
+ * CVE-2026-68514: PyOpenEXR deep RGB heap overflow (boo#1276846)
+ * CVE-2026-68515: exrmultiview heap OOB write (boo#1276848)
+ * CVE-2026-68513: PyOpenEXR RGB slice heap overflow (boo#1276845)
+ * CVE-2026-62986: PyOpenEXR stale heap disclosure (boo#1276861)
+ * CVE-2026-61703: PyOpenEXR deep mixed RGB heap overflow
+ * CVE-2026-61555: empty multiView channel crash (boo#1276859)
+ * CVE-2026-59985: ILP32 RLE decode heap OOB read (boo#1276858)
+ * CVE-2026-59984: ILP32 B44 scratch buffer overflow (boo#1276857)
+ * CVE-2026-59983: ILP32 deep tile count OOB read (boo#1276856)
+ * CVE-2026-59982: ILP32 DWAA buffer overflow (boo#1276853)
+ * CVE-2026-59981: SampleCountChannel row OOB read (boo#1276862)
+ * CVE-2026-59189: DeepImageChannel row OOB read (boo#1276855)
+ * CVE-2026-59187: exrmetrics deep pixel overflow (boo#1276851)
+ * CVE-2026-59186: ILP32 tiled RGBA OOB write (boo#1276850)
+ * CVE-2026-59184: FlatImageChannel row OOB write (boo#1276849)
+ * CVE-2026-59183: deep tile overflow OOB access (boo#1276428)
+
+-------------------------------------------------------------------
Old:
----
openexr-3.4.13.tar.gz
New:
----
openexr-3.4.16.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-OpenEXR.spec ++++++
--- /var/tmp/diff_new_pack.hcfrjk/_old 2026-10-18 19:27:17.963738458 +0200
+++ /var/tmp/diff_new_pack.hcfrjk/_new 2026-10-18 19:27:17.964738500 +0200
@@ -18,12 +18,12 @@
%define modname openexr
Name: python-OpenEXR
-Version: 3.4.13
+Version: 3.4.16
Release: 0
Summary: Python bindings for the OpenEXR image file format
License: BSD-3-Clause
URL: https://github.com/AcademySoftwareFoundation/OpenEXR
-Source0:
https://files.pythonhosted.org/packages/source/O/OpenEXR/%{modname}-%{version}.tar.gz
+Source0:
https://files.pythonhosted.org/packages/source/o/openexr/%{modname}-%{version}.tar.gz
Patch0: force-system-dependencies.patch
Patch1: remove-rpath.patch
Patch2: new_scikit-build-core.patch
++++++ openexr-3.4.13.tar.gz -> openexr-3.4.16.tar.gz ++++++
/work/SRC/openSUSE:Factory/python-OpenEXR/openexr-3.4.13.tar.gz
/work/SRC/openSUSE:Factory/.python-OpenEXR.new.3698736/openexr-3.4.16.tar.gz
differ: char 24, line 1
