Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1119608

Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: release.debian.org
Severity: normal
Tags: bullseye
User: release.debian.org@packages.debian.org
Usertags: pu

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Dear release team,
I'd like to update tinyexr in bullseye

[ Reason ]
The update fixes two vulnerabilities with low priority, i.e.
the security team has decided not to issue a DSA.

[ Impact ]
CVE-2022-34300: Heap overflow in DecodePixelData
CVE-2022-38529: Heap overflow in rleUncompress

[ Tests ]
I have verified that the changes fix the aforementioned vulnerabilities
and do not cause regressions in the package test suite.

[ Risks ]
tinyexr is a low popcon package with two reverse dependencies
(both of which I maintain).
Both code fixes are localized and unlikely to cause further issues.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
The update patches two statements in two functions


Cheers
Timo


-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEEJvtDgpxjkjCIVtam+C8H+466LVkFAmM5zIAACgkQ+C8H+466
LVnfmAv7BCTx2RPhA8gGGRGpHjQGY9o8gwWoTfKocWmPfJgEz3KLt3HntP7jo3fn
x6QooHIYCJ8iveUPD1J0zK5wgr//22Z9iER1Uuk/48SVAVKXDbuvak3wJer5ssDl
pAwluYXdMNREfOcu49sJ0cs5WmaPFsv7Kt1LLWfsTBRru3ekLwYI4AkHrCFpSfy0
SVEm4zF/99athm4Pd/teV1znvXcmhAW64UxoypsSJpdJm46kyZ2fHZPxMOVkaQGe
Vz4mROOoAMA60stDL0ot/iFjiUCen/dUlR/K8VP3h3l3NI6/hgLiGW7QvrVom07j
J0knQxnnMn+RVJGQRxaWFm/Qculk9xvY8H/uekvgZglWMxoW2FmJCvTnlizETCB6
MxIf0aHQRDgY+0g1VbAGsOZ12xjkTV5BhsKADN+eOHI0hfwiNJEkjMLVOnUNdnhC
qHYZILTfH4sTXs/xNlGJ49KJlFYmizsNwEIL0CTi6eVf062whzUFiRmDN/JYMvax
+/SrWuWb
=WbEi
-----END PGP SIGNATURE-----

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 Timo Röhling <roehling@debian.org> - 2022-10-02 19:50 +0200
  Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2022-10-14 13:00 +0200
    Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2022-10-14 14:00 +0200
      Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 Timo Röhling <timo@gaussglocke.de> - 2022-10-14 14:10 +0200
  Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2022-10-14 14:10 +0200
    Bug#1021130: bullseye-pu: package tinyexr/1.0.1+dfsg-1+deb11u1 Timo Röhling <roehling@debian.org> - 2022-10-14 14:40 +0200
  Bug#1021130: tinyexr 1.0.0+dfsg-1+deb11u1 flagged for acceptance Adam D Barratt <adam@adam-barratt.org.uk> - 2022-10-15 13:00 +0200

csiph-web