Release OpenEXR-libs-2.2.0-12.el8_10.3 ALSA-2026:82345
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 15/100
Research direction
This is a tracking issue for a security rebuild of the OpenEXR-libs and OpenEXR-devel 2.2.0 RPMs for EL8 across several architectures, covering five CVEs listed in the body. The payload names no repository files or entry points, so start from the linked CVE pages and the AlmaLinux updates process. Done means the fixed packages are built, signed and published for every listed architecture, which is maintainer work rather than a newcomer task.
Written by the indexing model from the issue text.
Description
OpenEXR security update
Severity: Important
Description
OpenEXR is a high dynamic-range (HDR) image file format developed by Industrial Light & Magic for use in computer imaging applications. This package contains libraries and sample applications for handling the format.
Security Fix(es):
- OpenEXR: OpenEXR: Out-of-bounds write vulnerability via crafted EXR files (CVE-2026-59184)
- OpenEXR: OpenEXR: Heap out-of-bounds write via crafted tiled EXR file (CVE-2026-59186)
- OpenEXR: OpenEXR: Information disclosure and denial of service due to out-of-bounds read (CVE-2026-59189)
- OpenEXR: OpenEXR: Heap out-of-bounds write in exrmultiview via crafted EXR files (CVE-2026-68515)
- OpenEXR: OpenEXR: Information disclosure and denial of service via out-of-bounds read (CVE-2026-59981)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected packages:
OpenEXR-libs-2.2.0-12.el8_10.3.i686
OpenEXR-libs-2.2.0-12.el8_10.3.x86_64
OpenEXR-libs-2.2.0-12.el8_10.3.s390x
OpenEXR-libs-2.2.0-12.el8_10.3.ppc64le
OpenEXR-libs-2.2.0-12.el8_10.3.aarch64
OpenEXR-devel-2.2.0-12.el8_10.3.i686
OpenEXR-devel-2.2.0-12.el8_10.3.x86_64
OpenEXR-devel-2.2.0-12.el8_10.3.ppc64le
OpenEXR-devel-2.2.0-12.el8_10.3.aarch64
OpenEXR-devel-2.2.0-12.el8_10.3.s390x
- Dominant language
- No language data
- Stars
- 2
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from AlmaLinux/updates
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
Difficulty 1/5 Under an hour Newbie friendliness 60/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
-
Difficulty 4/5 3-5 days Newbie friendliness 12/100
-
Difficulty 4/5 1-2 days Newbie friendliness 12/100
All issues in AlmaLinux/updates
Similar issues
-
ci(release): escape workflow commands in check_release_scan_evidence.py's top-level error outputOpenci-cd from-review-extraction python security severity:should-fix
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
LearningCircuit/local-deep-research#7453 ·
Maintainers usually reply within 2 days
-
Dev
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
ankidroid/Anki-Android#22555 ·
Maintainers usually reply within 1 day
-
Symlink in release archive attempts traversalPossibly taken @Tiancheng-Xu claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
redis/hiredis#1388 · 1 comment ·
Maintainers usually reply within 1 day
-
release
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
area: release lane: free-agent roadmap size: S type: task
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
arminazimi/evergreen#311 ·
Maintainers usually reply within 1 day