Skip to content

Commit 574289d

Browse files
cary-ilmcary-ilm
authored
Add release notes and news for v3.4.10, v3.3.10, v3.2.8 (AcademySoftwareFoundation#2368)
* notes for v3.2.8 Signed-off-by: Cary Phillips <cary@ilm.com> * notes for v3.3.10 Signed-off-by: Cary Phillips <cary@ilm.com> * notes for v3.4.10 Signed-off-by: Cary Phillips <cary@ilm.com> * Add CVE-2026-39886, CVE-2026-40244, CVE-2026-40250 to SECURITY.md Signed-off-by: Cary Phillips <cary@ilm.com> * fix range for CVE-2026-39886 Signed-off-by: Cary Phillips <cary@ilm.com> * fix date for 3.4.10 Signed-off-by: Cary Phillips <cary@ilm.com> * news for v3.4.10 Signed-off-by: Cary Phillips <cary@ilm.com> --------- Signed-off-by: Cary Phillips <cary@ilm.com>
1 parent 76e6496 commit 574289d

4 files changed

Lines changed: 101 additions & 3 deletions

File tree

‎CHANGES.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
# OpenEXR Release Notes
55

6+
* [Version 3.4.10](#version-3410-april-17-2026) April 17, 2026
67
* [Version 3.4.9](#version-349-april--3-2026) April 3, 2026
78
* [Version 3.4.8](#version-348-march-26-2026) March 26, 2026
89
* [Version 3.4.7](#version-347-march-15-2026) March 15, 2026
@@ -13,6 +14,7 @@
1314
* [Version 3.4.2](#version-342-october-15-2025) October 15, 2025
1415
* [Version 3.4.1](#version-341-october-8-2025) October 8, 2025
1516
* [Version 3.4.0](#version-340-september-5-2025) September 5, 2025
17+
* [Version 3.3.10](#version-339-april-17-2026) April 17, 2026
1618
* [Version 3.3.9](#version-339-april--4-2026) April 4, 2026
1719
* [Version 3.3.8](#version-338-march-1-2026) March 1, 2026
1820
* [Version 3.3.7](#version-337-february-19-2026) February 19, 2026
@@ -23,6 +25,7 @@
2325
* [Version 3.3.2](#version-332-november-11-2024) November 11, 2024
2426
* [Version 3.3.1](#version-331-october-8-2024) October 8, 2024
2527
* [Version 3.3.0](#version-330-september-30-2024) September 30, 2024
28+
* [Version 3.2.8](#version-328-april-17-2026) April 17, 2026
2629
* [Version 3.2.7](#version-327-april-3-2026) April 3, 2026
2730
* [Version 3.2.6](#version-326-march-1-2026) March 1, 2026
2831
* [Version 3.2.5](#version-325-november-4-2025) November 4, 2025
@@ -97,6 +100,48 @@
97100
* [Version 1.0.1](#version-101)
98101
* [Version 1.0](#version-10)
99102

103+
## Version 3.4.10 (April 17, 2026)
104+
105+
Patch release that addresses the following security vulnerabilities:
106+
107+
* [CVE-2026-39886](https://www.cve.org/CVERecord?id=CVE-2026-39886) HTJ2K Signed Integer Overflow in `ht_undo_impl()`
108+
* [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) Integer overflow in DWA `setupChannelData` `planarUncRle` pointer arithmetic (missed variant of CVE-2026-34589)
109+
* [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) Integer overflow in DWA decoder `outBufferEnd` pointer arithmetic (missed variant of CVE-2026-34589)
110+
111+
### Merged Pull Requests
112+
113+
* [2346](https://github.com/AcademySoftwareFoundation/openexr/pull/2346)
114+
Fix integer overflow in internal_dwa_compressor.h
115+
* [2345](https://github.com/AcademySoftwareFoundation/openexr/pull/2345)
116+
Fix HTJ2K bytes-per-line integer overflow in internal_ht.cpp
117+
* [2340](https://github.com/AcademySoftwareFoundation/openexr/pull/2340)
118+
Fix 3.4.9 cve list formatting
119+
* [2339](https://github.com/AcademySoftwareFoundation/openexr/pull/2339)
120+
fix link formatting typo
121+
* [2337](https://github.com/AcademySoftwareFoundation/openexr/pull/2337)
122+
notes and news for v3.4.9, v3.3.9, v3.2.7
123+
* [2334](https://github.com/AcademySoftwareFoundation/openexr/pull/2334)
124+
Add CVE-2026-34589,34588,34545,34544,34543,34380,34379,34378 to SECURITY.md
125+
* [2316](https://github.com/AcademySoftwareFoundation/openexr/pull/2316)
126+
Fix Pinned-Dependencies Scorecard alert in website workflow
127+
128+
### Merged Workflow Pull Requests
129+
130+
* [2360](https://github.com/AcademySoftwareFoundation/openexr/pull/2360)
131+
Bump actions/cache from 5.0.4 to 5.0.5
132+
* [2354](https://github.com/AcademySoftwareFoundation/openexr/pull/2354)
133+
Bump actions/upload-artifact from 7.0.0 to 7.0.1
134+
* [2343](https://github.com/AcademySoftwareFoundation/openexr/pull/2343)
135+
Bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0
136+
* [2341](https://github.com/AcademySoftwareFoundation/openexr/pull/2341)
137+
Bump jmertic/slack-release-notifier from 32206e01ee0b0f66865d2be13bb3c62e474b5ce0 to 9d7d3a84563d2ebc8f7b2271be6c9568fedd7f3a
138+
* [2338](https://github.com/AcademySoftwareFoundation/openexr/pull/2338)
139+
Fix CodeQL SARIF upload ref for pull_request workflows
140+
* [2336](https://github.com/AcademySoftwareFoundation/openexr/pull/2336)
141+
Bump pypa/cibuildwheel from 3.4.0 to 3.4.1
142+
* [2333](https://github.com/AcademySoftwareFoundation/openexr/pull/2333)
143+
Add CI test to validate "cmake --install .. --prefix <path>
144+
100145
## Version 3.4.9 (April 3, 2026)
101146

102147
Patch release that addresses several security vulnerabilities.
@@ -822,6 +867,18 @@ Fetch master branch of libdeflate on main
822867
* [1852](https://github.com/AcademySoftwareFoundation/openexr/pull/1852)
823868
Add an option to use TBB as the global provider
824869

870+
## Version 3.3.10 (April 17, 2026)
871+
872+
Patch release that addresses the following security vulnerabilities:
873+
874+
* [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) Integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)
875+
* [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) Integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)
876+
877+
### Merged Pull Requests
878+
879+
* [2346](https://github.com/AcademySoftwareFoundation/openexr/pull/2346)
880+
Fix integer overflow in internal_dwa_compressor.h
881+
825882
## Version 3.3.9 (April 4, 2026)
826883

827884
Patch release for v3.3 that addresses the following security vulnerabilities:
@@ -1507,6 +1564,18 @@ Fix macOS arm64 build
15071564
Propagate dwa core 3 1
15081565
* [1418](https://github.com/AcademySoftwareFoundation/openexr/pull/1418)
15091566

1567+
## Version 3.2.8 (April 17, 2026)
1568+
1569+
Patch release that addresses the following security vulnerabilities:
1570+
1571+
* [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) Integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)
1572+
* [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) Integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)
1573+
1574+
### Merged Pull Requests
1575+
1576+
* [2346](https://github.com/AcademySoftwareFoundation/openexr/pull/2346)
1577+
Fix integer overflow in internal_dwa_compressor.h
1578+
15101579
## Version 3.2.7 (April 3, 2026)
15111580

15121581
Patch release for v3.2 that addresses the following security vulnerabilities:

‎SECURITY.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ rapidly and post patches within 14 days if possible.
2020

2121
| CVE | Affected Versions | Patched Versions |
2222
| --- | ----------------- | ---------------- |
23+
| [CVE-2026-40250](https://www.cve.org/CVERecord?id=CVE-2026-40250) | 3.2.0–3.2.7, 3.3.0–3.3.9, 3.4.0–3.4.9 | 3.2.8, 3.3.10, 3.4.10 |
24+
| [CVE-2026-40244](https://www.cve.org/CVERecord?id=CVE-2026-40244) | 3.2.0–3.2.7, 3.3.0–3.3.9, 3.4.0–3.4.9 | 3.2.8, 3.3.10, 3.4.10 |
25+
| [CVE-2026-39886](https://www.cve.org/CVERecord?id=CVE-2026-39886) | 3.4.0–3.4.9 | 3.4.10 |
2326
| [CVE-2026-34589](https://www.cve.org/CVERecord?id=CVE-2026-34589) | 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.8 | 3.2.7, 3.3.9, 3.4.9 |
2427
| [CVE-2026-34588](https://www.cve.org/CVERecord?id=CVE-2026-34588) | 3.1.x, 3.2.0–3.2.6, 3.3.0–3.3.8, 3.4.0–3.4.8 | 3.2.7, 3.3.9, 3.4.9 |
2528
| [CVE-2026-34545](https://www.cve.org/CVERecord?id=CVE-2026-34545) | 3.4.0–3.4.6 | 3.4.7 |

‎website/latest_news_title.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
..
22
SPDX-License-Identifier: BSD-3-Clause
33
Copyright (c) Contributors to the OpenEXR Project.
4-
.. |latest-news-title| replace:: **April 3, 2026 - OpenEXR 3.4.9 Released**
4+
.. |latest-news-title| replace:: **April 17, 2026 - OpenEXR 3.4.10 Released**

‎website/news.rst‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,37 @@ News
1717

1818

1919
|latest-news-title|
20-
=======================================
20+
========================================
2121

2222
.. _LatestNewsStart:
2323

24+
Patch release that addresses the following security vulnerabilities:
25+
26+
* `CVE-2026-39886 <https://www.cve.org/CVERecord?id=CVE-2026-39886>`_ HTJ2K Signed Integer Overflow in ``ht_undo_impl()``
27+
* `CVE-2026-40244 <https://www.cve.org/CVERecord?id=CVE-2026-40244>`_ Integer overflow in DWA ``setupChannelData`` ``planarUncRle`` pointer arithmetic (missed variant of CVE-2026-34589)
28+
* `CVE-2026-40250 <https://www.cve.org/CVERecord?id=CVE-2026-40250>`_ Integer overflow in DWA decoder ``outBufferEnd`` pointer arithmetic (missed variant of CVE-2026-34589)
29+
30+
.. _LatestNewsEnd:
31+
32+
April 17, 2026 - OpenEXR 3.3.10 Released
33+
========================================
34+
35+
Patch release for v3.3 that addresses the following security vulnerabilities:
36+
37+
* `CVE-2026-40244 <https://www.cve.org/CVERecord?id=CVE-2026-40244>`_ Integer overflow in DWA ``setupChannelData`` ``planarUncRle`` pointer arithmetic (missed variant of CVE-2026-34589)
38+
* `CVE-2026-40250 <https://www.cve.org/CVERecord?id=CVE-2026-40250>`_ Integer overflow in DWA decoder ``outBufferEnd`` pointer arithmetic (missed variant of CVE-2026-34589)
39+
40+
April 17, 2026 - OpenEXR 3.2.8 Released
41+
=======================================
42+
43+
Patch release for v3.2 that addresses the following security vulnerabilities:
44+
45+
* `CVE-2026-40244 <https://www.cve.org/CVERecord?id=CVE-2026-40244>`_ Integer overflow in DWA ``setupChannelData`` ``planarUncRle`` pointer arithmetic (missed variant of CVE-2026-34589)
46+
* `CVE-2026-40250 <https://www.cve.org/CVERecord?id=CVE-2026-40250>`_ Integer overflow in DWA decoder ``outBufferEnd`` pointer arithmetic (missed variant of CVE-2026-34589)
47+
48+
April 3, 2026 - OpenEXR 3.4.9 Released
49+
=======================================
50+
2451
Patch release that addresses several security vulnerabilities.
2552

2653
This release also fixes a build issue where the library symlinks would
@@ -35,7 +62,6 @@ This release addresses the following CVEs:
3562
* `CVE-2026-34379 <https://www.cve.org/CVERecord?id=CVE-2026-34379>`_ Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)
3663
* `CVE-2026-34378 <https://www.cve.org/CVERecord?id=CVE-2026-34378>`_ Signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x
3764

38-
.. _LatestNewsEnd:
3965

4066
April 3, 2026 - OpenEXR 3.3.9 Released
4167
=======================================

0 commit comments

Comments
 (0)