FEDORA-2026-502486fc61 — security update for usd

stable

usd-26.03-3.fc44

FEDORA-2026-502486fc61 created by music 6 months ago for Fedora 44

Backport several OpenEXRCore security fixes

Fixes CVE-2026-34378 / GHSA-v76p-4qvv-vh4g; closes #2455493
Fixes CVE-2026-34380 / GHSA-q3v8-hw4m-59w5; closes #2455534
Fixes CVE-2026-34588 / GHSA-588r-cr5c-w6hf; closes #2455505
Fixes CVE-2026-34589 / GHSA-p8xc-w3q4-h64x; closes #2455501
Fixes CVE-2026-34379 / GHSA-w88v-vqhq-5p24; closes #2455497

Backport fix for CVE-2026-34544 in OpenEXRCore

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2026-502486fc61

This update has been submitted for testing by music.

6 months ago

This update's test gating status has been changed to 'ignored'.

6 months ago

This update has obsoleted usd-26.03-2.fc44, and has inherited its bugs and notes.

6 months ago

This update has been pushed to testing.

6 months ago

This update has been submitted for stable by bodhi.

There is an ongoing freeze; this will be pushed to stable after the freeze is over.

6 months ago

This update has been pushed to stable.

6 months ago

Please log in to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

6 months ago

in testing

6 months ago

in stable

6 months ago

approved

6 months ago

Builds

usd-26.03-3.fc44

BZ#2454226 CVE-2026-34544 usd: OpenEXR: Memory corruption and Denial of Service via crafted EXR file processing [fedora-all]

BZ#2455493 CVE-2026-34378 usd: OpenEXR: Denial of Service via crafted EXR file integer overflow [fedora-all]

BZ#2455497 CVE-2026-34379 usd: OpenEXR: Denial of Service due to misaligned memory write during EXR file decoding [fedora-all]

BZ#2455501 CVE-2026-34589 usd: OpenEXR: Memory corruption leading to arbitrary code execution or denial of service [fedora-all]

BZ#2455505 CVE-2026-34588 usd: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file [fedora-all]

BZ#2455534 CVE-2026-34380 usd: OpenEXR: Denial of Service due to signed integer overflow in image decoding [fedora-all]

usd-26.03-3.fc44

Automated Test Results

ignored