Format: 1.8
Date: Thu, 20 Aug 2026 19:49:50 +0300
Source: openexr
Architecture: source
Version: 3.4.14-0.1
Distribution: unstable
Urgency: medium
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel@lists.alioth.debian.org>
Changed-By: Adrian Bunk <bunk@debian.org>
Closes: 1132578 1132579 1132580 1133188 1134642 1135946 1136001 1136879 1144763 1144878
Changes:
 openexr (3.4.14-0.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * New upstream release. (Closes: #1136879)
     - Fixes FTBFS with glibc 2.43. (Closes: #1144878)
     - CVE-2026-34378: Signed integer overflow in generic_unpack()
     - CVE-2026-34379: Misaligned write in LossyDctDecoder_execute
     - CVE-2026-34380: Signed integer overflow in undo_pxr24_impl()
     - CVE-2026-34588: Signed 32-bit Overflow in PIZ Decoder
     - CVE-2026-34589: DWA Lossy Decoder Heap Out-of-Bounds Write
     (Closes: #1133188)
     - CVE-2026-34543: Heap information disclosure in PXR24 decompression
       (Closes: #1132580)
     - CVE-2026-34544: Integer overflow in uncompress_b44_impl()
       (Closes: #1132579)
     - CVE-2026-34545: Integer overflow in HTJ2K decoder
       (Closes: #1132578)
     - CVE-2026-39886: Signed Integer Overflow in ht_undo_impl()
     - CVE-2026-40244: Integer overflow in DWA setupChannelData
     - CVE-2026-40250: Integer overflow in DWA decoder
     (Closes: #1134642)
     - CVE-2026-41142: Integer overflow in ImageChannel::resize()
       (Closes: #1135946)
     - CVE-2026-42216: Out-of-bounds read in IDManifest::init()
     - CVE-2026-42217: Shift exponent overflow in readVariableLengthInteger()
     (Closes: #1136001)
     - CVE-2026-44663: Integer overflow in HTJ2K decoder
     - CVE-2026-45696: Heap buffer overflow in ht_undo_impl()
     - CVE-2026-59183: Signed Integer Overflow in Deep Tile Decoding
     - CVE-2026-59184: OpenEXRUtil FlatImageChannel row OOB write
     - CVE-2026-59186: OpenEXR ILP32 TiledRgbaInputFile large tile OOB write
     - CVE-2026-59187: OpenEXR exrmetrics deep pixelmode heap buffer overflow
     - CVE-2026-59189: OpenEXRUtil DeepImageChannel heap OOB read
     - CVE-2026-59981: OpenEXRUtil SampleCountChannel heap OOB read
     - CVE-2026-59982: ILP32 DWAA InputFile packed AC buffer overflow
     - CVE-2026-59983: ILP32 DeepTiledInputFile sample count table OOB read
     - CVE-2026-59984: ILP32 B44 InputFile decode scratch buffer overflow
     - CVE-2026-59985: ILP32 OpenEXRCore RLE decode heap OOB read DoS
     - CVE-2026-61555: Empty multiView viewFromChannelName file crash
   * Generate Provides that includes the Imath version and use in the shlibs.
     (Closes: #1144763)
   * Disable test that fails on armhf instead of ignoring all test failures
     on armhf.
   * Ignore test failures on all big endian architectures.
   * Attempt to fix FTBFS on hurd-amd64.
   * Ignore test failures on Hurd.
Checksums-Sha1:
 4e1228f642baa3d056345996075470e88150a253 2261 openexr_3.4.14-0.1.dsc
 c0bb14f1dfb0c9a6f2e38725397013ce9ce4d6b8 20598272 openexr_3.4.14.orig.tar.xz
 674d0668a9d7ed5619bb34670cab2513dbd573cd 19384 openexr_3.4.14-0.1.debian.tar.xz
Checksums-Sha256:
 30540eb3d46620be9aaed388d0c179d5846a890e94baf48e0f1650ca3cd4d7a7 2261 openexr_3.4.14-0.1.dsc
 5bc1a561a418ac59b5c309e42820dda0e6f4c087f10b5cf8e30c4899c1d68f09 20598272 openexr_3.4.14.orig.tar.xz
 d1f1929c2045562640f5c3cda3ef93ca49827e2ad91ae90fde243bd16a0aeeef 19384 openexr_3.4.14-0.1.debian.tar.xz
Files:
 9d9256429c816c2e26a22ad778d85ed9 2261 graphics optional openexr_3.4.14-0.1.dsc
 64216513dde4a579c60354b610bb4d6e 20598272 graphics optional openexr_3.4.14.orig.tar.xz
 e3937bbb7954bbf50ee6716787358e25 19384 graphics optional openexr_3.4.14-0.1.debian.tar.xz
Location: DEFERRED
Delayed-Until: 2026-08-22 11:43:02
Delay-Remaining: 0 days 20:46
Fingerprint: 3AFA757FAC6EA11D2FF45DF088D24287A2D898B1