[CLSA-2026:1788167338] Fix CVE(s): CVE-2021-20298, CVE-2021-20299, CVE-2021-20304

Type:

security

Severity:

Important

Release date:

2026-08-31 09:09:11 UTC

Description:

   * SECURITY UPDATE: Memory exhaustion in the B44 compressor
     - debian/patches/CVE-2021-20298.patch: size _tmpBuffer in elements
       rather than bytes in IlmImf/ImfB44Compressor.cpp.
     - CVE-2021-20298
   * SECURITY UPDATE: Null dereference on multipart files with no parts
     - debian/patches/CVE-2021-20299.patch: require at least one header in
       IlmImf/ImfMultiPartInputFile.cpp.
     - CVE-2021-20299
   * SECURITY UPDATE: Undefined right shift in hufDecode
     - debian/patches/CVE-2021-20304.patch: reject over-long Huffman code
       lengths in IlmImf/ImfHuf.cpp.
     - CVE-2021-20304

CVEs fixed:

Updated packages:

libopenexr-dev_2.2.0-11.1ubuntu1.9+tuxcare.els2_amd64.deb
sha:8401e4f9b499ad106bf8b58c636f86bbdfbf4737
libopenexr22_2.2.0-11.1ubuntu1.9+tuxcare.els2_amd64.deb
sha:e2da466eaf6b8780080624ff792420d7729796b6
openexr_2.2.0-11.1ubuntu1.9+tuxcare.els2_amd64.deb
sha:d6d51a6245b6ef72b4d9275ad2cf8578fbe54a16
openexr-doc_2.2.0-11.1ubuntu1.9+tuxcare.els2_all.deb
sha:1b6c58f20b26a3c433d8a5732568f7ee585441d6

Notes:

This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.