Your message dated Mon, 19 Oct 2026 09:34:10 +0000
with message-id <[email protected]>
and subject line Bug#1149061: fixed in openexr 3.4.16+ds-1
has caused the Debian Bug report #1149061,
regarding openexr: CVE-2026-88384
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149061: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149061
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: openexr
Version: 3.4.15+ds-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/AcademySoftwareFoundation/openexr/issues/2612
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for openexr.
CVE-2026-88384[0]:
| OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++
| attribute parsing path. A specially crafted EXR file containing an
| unknown-type attribute with dataSize set to zero causes the parser
| to create an opaque attribute with a NULL packed_data pointer. The
| OpaqueAttribute constructor passes the NULL pointer to memcpy()
| without validating the zero-size condition, resulting in undefined
| behavior and process termination, leading to denial of service.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-88384
https://www.cve.org/CVERecord?id=CVE-2026-88384
[1] https://github.com/AcademySoftwareFoundation/openexr/issues/2612
[2] https://github.com/AcademySoftwareFoundation/openexr/pull/2615
[3]
https://github.com/AcademySoftwareFoundation/openexr/commit/e782bcc1ffe1cc9edfaa5dbad4f28e866eaf9bbb
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: openexr
Source-Version: 3.4.16+ds-1
Done: Sébastien Noel <[email protected]>
We believe that the bug you reported is fixed in the latest version of
openexr, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sébastien Noel <[email protected]> (supplier of updated openexr package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 19 Oct 2026 10:56:34 +0200
Source: openexr
Architecture: source
Version: 3.4.16+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PhotoTools Maintainers
<[email protected]>
Changed-By: Sébastien Noel <[email protected]>
Closes: 1136900 1149061
Changes:
openexr (3.4.16+ds-1) unstable; urgency=medium
.
* Team upload
* New upstream release
* Backport upstream patch to fix CVE-2026-88384 (Closes: #1149061)
* Changes libopenexr-3-4-33 Breaks/Replaces in d/control:
now "libopenexr-3-1-30 (>> 3.4.6)" instead of "<< 3.4.6+ds-3"
(Closes: #1136900)
Checksums-Sha1:
64ff161d97f15fd0cf4b404a3840a55a7f2f9e4d 2004 openexr_3.4.16+ds-1.dsc
dda4322e349b0fb51e2bbaca6aaac7c5721cf9e0 20599088 openexr_3.4.16+ds.orig.tar.xz
19489b05aee30d0e8c8f2d2d2f9b364e0c3a51ab 20996
openexr_3.4.16+ds-1.debian.tar.xz
62101bbf835ece4289a68a21835a1a7694b0fd28 7830
openexr_3.4.16+ds-1_amd64.buildinfo
Checksums-Sha256:
a70938090585da5b1be57e1c5ec4fed8f1c2dc73f29e182e75f528e6b312a32a 2004
openexr_3.4.16+ds-1.dsc
1ed724eb5bd0ea90fd4083ca2c4440e06d524a3af477dd295e54614ea0e63949 20599088
openexr_3.4.16+ds.orig.tar.xz
fbad76516a178251b0f4a78b08c9d50cafb0e16c808dff41c3ad813810af1a63 20996
openexr_3.4.16+ds-1.debian.tar.xz
9ae893eeb97eddb4396862867e9261f02a8013470fb1367b2ec30eac99afd1bf 7830
openexr_3.4.16+ds-1_amd64.buildinfo
Files:
41fcdfe0e1922a5377eeec0310cf4a8d 2004 graphics optional openexr_3.4.16+ds-1.dsc
52c3639495783687ebf77184f6272ba3 20599088 graphics optional
openexr_3.4.16+ds.orig.tar.xz
8d18333942b1ef7e9a1fed974bb64a85 20996 graphics optional
openexr_3.4.16+ds-1.debian.tar.xz
718e2ef36ec6307800b232bb38baa4cf 7830 graphics optional
openexr_3.4.16+ds-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQFHBAEBCgAxFiEEdlP6my3wO8aMe9FCrKAIuMk0p9QFAmrV4W0THHR3b2xpZmVA
ZGViaWFuLm9yZwAKCRCsoAi4yTSn1EzvCADBp+gjHc+stu/B1ldCZc/Nt2huws0X
8PmB3B5hetQdKdHprLFhSop5KU5m2kX0mQH0bN0SzF4u3ZjXXROb6RGwD/3bOrbZ
oC7ZLuLKi9cD9IfnEB21yV1mkStd+GUFVd+9aYPqxfE+zBINhVIUls5qP7l+svVP
KqXGyi/32CESD1HlXTnnZmp2cvlKLJv8IG6PnBjkYmFyfFyohkK54BI2m7Unx88e
rq7ZQNxvYfA5JBs32Xwu6XL7bPiQBAIZSm6gDGiVbcyF+H/M7+LgNzhhxjD9jAA9
IkSHmvft6IKDzOS226dQ+7l6EJiHZJXVHr/qRGdhenTvIJ8bLMTn6AOU
=rcoV
-----END PGP SIGNATURE-----
pgpoEonQVF4sp.pgp
Description: PGP signature
--- End Message ---
