SUSE-SU-2020:3934-1

Details

Description of the patch:

This update for openexr fixes the following issues:

Security issues fixed:

CVE-2020-16587: Fixed a heap-based buffer overflow in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp (bsc#1179879).
CVE-2020-16588: Fixed a null pointer deference in generatePreview (bsc#1179879).
CVE-2020-16589: Fixed a heap-based buffer overflow in writeTileData in ImfTiledOutputFile.cpp (bsc#1179879).

Affected Packages

libIlmImf-2_2-23

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise Desktop 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP1

Fixed in:

2.2.1-3.21.1

libIlmImfUtil-2_2-23

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise Desktop 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP1

Fixed in:

2.2.1-3.21.1

openexr-devel

SUSE Enterprise Storage 6SUSE Enterprise Storage 7SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise Desktop 15 SP2SUSE Linux Enterprise High Performance Computing 15 SP1

Fixed in:

2.2.1-3.21.1

References

ADVISORY

https://bugzilla.suse.com/1179879

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2020-December/008121.html

ADVISORY

https://www.suse.com/security/cve/CVE-2020-16587/

ADVISORY

https://www.suse.com/security/cve/CVE-2020-16588/

ADVISORY

https://www.suse.com/security/cve/CVE-2020-16589/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2020/suse-su-20203934-1/