Check the OpenEXR Library Your Debian Image Tool Actually Uses

An EXR image can reach a library without the person opening it ever seeing the library’s name. That is the practical starting point for Debian’s November 11 OpenEXR security update. The advisory covers malformed image files that can crash a program or cause memory reads and writes outside their intended bounds. Before deciding a machine is covered, find the copy used by the image tool or service you rely on.

What changes in Trixie

Debian lists 3.2.12-1~deb13u1 as the fixed source-package revision for stable Trixie. The update moves to OpenEXR’s 3.2 series. Debian says it keeps Trixie’s existing library ABI, the interface that compiled applications expect when they load the shared library. That makes this a distribution update with an upstream version change inside it. It is not a request to rebuild every program on the machine against a new interface.

Start with the installed packages. The command dpkg-query -W 'libopenexr*' openexr lists matching packages and their versions. You may have libraries installed without the OpenEXR command-line tools. A missing tools package does not tell you that your editor has no OpenEXR support. For each installed package you need to update, apt-cache policy followed by its name shows the installed and candidate revisions. Compare the complete revision with Debian’s advisory, including the deb13u1 part.

Our earlier article on Debian’s NSS root removal used the same kind of check. A version headline is less useful than knowing which distribution package is on the system. Refresh the package lists and install the available security update through your normal package manager. If the candidate still looks old, check the configured repositories and any package pinning before concluding that there is no update for your system.

Give the application a fresh process

A package update replaces files on disk. A process already using a shared library can continue to hold the old copy in memory. Close and reopen the image editor after updating. For a server-side image worker, use the service’s normal restart procedure. Then send a known good image through its usual input path and check that the application still produces the expected output. That is a compatibility check after the update, not a test of every flaw in the advisory.

There is one more place to look if the application supplies its own libraries. A container or a bundled application may have a separate OpenEXR copy. Updating Debian packages on the host will not replace that file. Establish where it came from and follow that package or application’s update path. The source of the library is what determines which fix the program will use.