v3.3.15

Patch release that addresses the following security vulnerabilities:

• CVE Pending (GHSA-WHF5-29MJ-GP53) Heap Out-of-Bounds Write via Signed Integer Overflow in DWAA/DWAB LossyDctDecoder
• CVE Pending (GHSA-RXWG-X3WX-PGFH) Heap out-of-bounds write via 32-bit tile-area integer overflow in DeepTiledOutputFile (deep-image re-save path) — possible incomplete fix of PR #939
• CVE Pending (GHSA-RJG8-982X-JHC2) Uninitialized Heap Memory Disclosure in DWA Decompression via Short zlib Stream Mapped to Success
• CVE Pending (GHSA-J76P-H7GW-VMPF) Heap buffer overflow in the OpenEXR Python bindings when two RGB channel groups coalesce to the same key
• CVE Pending (GHSA-G248-596F-9995) Unvalidated extra chlist header attributes merged into Header::channels() cause a heap overflow in run_fill
• CVE Pending (GHSA-FRX8-5P4H-J8M7) Heap OOB Write via Integer Overflow in B44 Chunk Unpacked-Size Computation — Remote Code Execution in OpenEXRCore
• CVE Pending (GHSA-638X-X7MR-89XC) Out-of-bounds write at an attacker-chosen displacement in legacy Python InputFile.channel()
• CVE Pending (GHSA-3CP4-779M-H837) Use-after-free in OpenEXRCore exr_copy_unset_attributes() when a channel name exceeds 31 bytes

See CHANGES.md for more details.

Contributors