OpenEXR v2.2.2 Release Notes
Release Date: 2020-04-30 // almost 4 years ago-
🚀 This is a patch release that includes fixes for the following security vulnerabilities:
- CVE-2020-11765 There is an off-by-one error in use of the ImfXdr.h read function by DwaCompressor::Classifier::ClasGsifier, leading to an out-of-bounds read.
- CVE-2020-11764 There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.
- CVE-2020-11763 There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp.
- CVE-2020-11762 There is an out-of-bounds read and write in DwaCompressor::uncompress in ImfDwaCompressor.cpp when handling the UNKNOWN compression case.
- CVE-2020-11761 There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp.
- CVE-2020-11760 There is an out-of-bounds read during RLE uncompression in rleUncompress in ImfRle.cpp.
- CVE-2020-11759 Because of integer overflows in CompositeDeepScanLine::Data::handleDeepFrameBuffer and readSampleCountForLineBlock, an attacker can write to an out-of-bounds pointer.
- ⚡️ CVE-2020-11758 There is an out-of-bounds read in ImfOptimizedPixelReading.h.