==========================================================================
Ubuntu Security Notice USN-4418-1
July 06, 2020

openexr vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 20.04 LTS
– Ubuntu 19.10
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

OpenEXR could be made to crash or run programs if it opened a specially
crafted file.

Software Description:
– openexr: tools for the OpenEXR image format

Details:

It was discovered that OpenEXR incorrectly handled certain malformed EXR
image files. If a user were tricked into opening a crafted EXR image file,
a remote attacker could cause a denial of service, or possibly execute
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
libopenexr24 2.3.0-6ubuntu0.2
openexr 2.3.0-6ubuntu0.2

Ubuntu 19.10:
libopenexr23 2.2.1-4.1ubuntu1.2
openexr 2.2.1-4.1ubuntu1.2

Ubuntu 18.04 LTS:
libopenexr22 2.2.0-11.1ubuntu1.3
openexr 2.2.0-11.1ubuntu1.3

Ubuntu 16.04 LTS:
libopenexr22 2.2.0-10ubuntu2.3
openexr 2.2.0-10ubuntu2.3

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4418-1
CVE-2020-15305, CVE-2020-15306

Package Information:
https://launchpad.net/ubuntu/+source/openexr/2.3.0-6ubuntu0.2
https://launchpad.net/ubuntu/+source/openexr/2.2.1-4.1ubuntu1.2
https://launchpad.net/ubuntu/+source/openexr/2.2.0-11.1ubuntu1.3
https://launchpad.net/ubuntu/+source/openexr/2.2.0-10ubuntu2.3

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl8DfjkACgkQZWnYVadE
vpOwMRAAh61tHtHfEvFy9bX7TADoyXSFNqgdmp3SR+KUGgX3pwy1I7yuHCIH6PTo
WLDKBmyIoEiqCI+gSycfKrj7MLFR4QsK+lo6/jKCMxRsBq2Er0lrGfl+nlI275s/
ycPYkoGMPHMUKzahKjgHiNYUXnmRSoVzN1LqOU9XeuH/i0fUoZ27YNbLX9VjpHmb
ufehmtJOdanzfbhTh1stre7nkDx70gUHkV6VeLgLDjEf+71Eqr0qF9TqZ/Nn3I2C
iK/TlWt2yuRItwqQAkbiES0T7Az+yrm7RCoJLohYk4oqqNtPSRVPvQq6L5eFYR0v
3JN7xZrz/zywZ8TNd4Dm2tksbawjgYTZ2hEeJXiEclg12ZaOuzPA2Ph1XQSkd2/B
6a0M27eAW/QqJMWRI+STS+YLMh6Izygw0gbd4Xx/6nQQpoKVdaeYmRYHThYRd/Te
1dsTYWRKW9va5rHCkJff22v2sd2HO453/ycSoE9gz3Ux4lfDLZzj5Usf2WmiZJ68
Jtz8r+2fhvNGBuSo8G7fiX0n6Tpp3Ve+lMBjsMPYauoM15DBYv00A+pCSCI1rWRw
EHKHtWym1w/vSx7ZTj/VgiUcznY8trCIluFsUYtJawZKnSWXb7bgOvgR8/bpiJfI
gvW5bVqYTbHCHolrfObbOrA9c42eIGnSp3Q+T7A9MtdRJlKbEvs=
=y8hZ
—–END PGP SIGNATURE—–
—