ArchLinux: 202107-14: openexr: arbitrary code execution
Summary
A heap-buffer overflow was found in the readChars function of OpenEXR before version 3.0.5. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR.
Resolution
Upgrade to 3.0.5-1.
# pacman -Syu "openexr>=3.0.5-1"
The problem has been fixed upstream in version 3.0.5.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1970987 https://github.com/AcademySoftwareFoundation/openexr/issues/1033 https://github.com/AcademySoftwareFoundation/openexr/pull/1037 https://github.com/AcademySoftwareFoundation/openexr/commit/b054116e57ebf62739a17217f922359b174d1332 https://security.archlinux.org/CVE-2021-3598
Workaround
None.