Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-11764: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp. 1828990: CVE-2020-11764 OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp CVE-2020-11763: An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated by ImfTileOffsets.cpp. 1828995: CVE-2020-11763 OpenEXR: std::vector out-of-bounds read and write in ImfTileOffsets.cpp CVE-2020-11761: An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demonstrated by FastHufDecoder::refill in ImfFastHuf.cpp. 1829002: CVE-2020-11761 OpenEXR: out-of-bounds read during Huffman uncompression
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | OpenEXR | 0:1.7.1-8.amzn2.0.1 |
| Amazon Linux · 2 | OpenEXR-debuginfo | 0:1.7.1-8.amzn2.0.1 |
| Amazon Linux · 2 | OpenEXR-devel | 0:1.7.1-8.amzn2.0.1 |
| Amazon Linux · 2 | OpenEXR-libs | 0:1.7.1-8.amzn2.0.1 |
Vulnerabilities 3
-
Unscored —
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds read during Huffman uncompression, as demons…
-
Unscored —
An issue was discovered in OpenEXR before 2.4.1. There is an std::vector out-of-bounds read and write, as demonstrated …
-
Unscored —
An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bounds write in copyIntoFrameBuffer in ImfMisc.cpp.