<?xml version='1.0' encoding='UTF-8'?>
<oval_definitions xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:red-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">
  <generator>
    <oval:product_name>Tuxcare Errata System</oval:product_name>
    <oval:product_version>0.0.1</oval:product_version>
    <oval:schema_version>5.10</oval:schema_version>
    <oval:timestamp>2026-09-28T10:19:08</oval:timestamp>
  </generator>
  <definitions>
    <definition class="patch" id="oval:com.tuxcare.clsa:def:1790590713" version="1">
      <metadata>
        <title>openexr: Fix of CVE-2026-42217</title>
        <affected family="unix">
          <platform>TuxCare 9.8</platform>
        </affected>
        <reference ref_id="CLSA-2026:1790590713" ref_url="https://cve.tuxcare.com/els/releases/CLSA-2026:1790590713" source="CLSA"/>
        <reference ref_id="CVE-2026-42217" ref_url="https://cve.tuxcare.com/els/cve/CVE-2026-42217" source="CVE"/>
        <description>- CVE-2026-42217: reject IDManifest variable-length integers whose shift
  reaches 64 bits, avoiding undefined behaviour in readVariableLengthInteger()</description>
        <advisory from="packager@tuxcare.com">
          <severity>Critical</severity>
          <rights>TuxCare License Agreement</rights>
          <issued date="2026-09-28"/>
          <updated date="2026-09-28"/>
          <cve cvss3="9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" cwe="CWE-190" href="https://cve.tuxcare.com/els/cve/CVE-2026-42217" impact="critical" public="20260507">CVE-2026-42217</cve>
          <affected_cpe_list>
            <cpe>cpe:/o:almalinux:almalinux:9::baseos</cpe>
            <cpe>cpe:/o:resf:rocky_linux:9.8</cpe>
          </affected_cpe_list>
        </advisory>
      </metadata>
      <criteria operator="OR">
        <criterion comment="TuxCare 9.8 isn't installed" test_ref="oval:com.tuxcare.clsa:tst:1790590713001"/>
        <criterion comment="openexr is earlier than 0:3.1.1-3.el9_8.4.tuxcare.els1" test_ref="oval:com.tuxcare.clsa:tst:1790590713002"/>
        <criteria operator="AND">
          <criterion comment="openexr isn't signed with TuxCare 9.8 key" test_ref="oval:com.tuxcare.clsa:tst:1790590713003"/>
          <criterion comment="openexr isn't signed with TuxCare key" test_ref="oval:com.tuxcare.clsa:tst:1790590713004"/>
        </criteria>
        <criterion comment="openexr-devel is earlier than 0:3.1.1-3.el9_8.4.tuxcare.els1" test_ref="oval:com.tuxcare.clsa:tst:1790590713005"/>
        <criteria operator="AND">
          <criterion comment="openexr-devel isn't signed with TuxCare 9.8 key" test_ref="oval:com.tuxcare.clsa:tst:1790590713006"/>
          <criterion comment="openexr-devel isn't signed with TuxCare key" test_ref="oval:com.tuxcare.clsa:tst:1790590713007"/>
        </criteria>
        <criterion comment="openexr-libs is earlier than 0:3.1.1-3.el9_8.4.tuxcare.els1" test_ref="oval:com.tuxcare.clsa:tst:1790590713008"/>
        <criteria operator="AND">
          <criterion comment="openexr-libs isn't signed with TuxCare 9.8 key" test_ref="oval:com.tuxcare.clsa:tst:1790590713009"/>
          <criterion comment="openexr-libs isn't signed with TuxCare key" test_ref="oval:com.tuxcare.clsa:tst:1790590713010"/>
        </criteria>
      </criteria>
    </definition>
  </definitions>
  <tests>
    <ind-def:textfilecontent54_test check="none satisfy" check_existence="none_exist" comment="TuxCare 9.8 isn't installed" id="oval:com.tuxcare.clsa:tst:1790590713001" version="1">
      <ind-def:object object_ref="oval:com.tuxcare.clsa:obj:1790590713001"/>
    </ind-def:textfilecontent54_test>
    <red-def:rpminfo_test check="at least one" comment="openexr is earlier than 0:3.1.1-3.el9_8.4.tuxcare.els1" id="oval:com.tuxcare.clsa:tst:1790590713002" version="1">
      <red-def:object object_ref="oval:com.tuxcare.clsa:obj:1790590713002"/>
      <red-def:state state_ref="oval:com.tuxcare.clsa:ste:1790590713002"/>
    </red-def:rpminfo_test>
    <red-def:rpminfo_test check="none satisfy" comment="openexr isn't signed with TuxCare 9.8 key" id="oval:com.tuxcare.clsa:tst:1790590713003" version="1">
      <red-def:object object_ref="oval:com.tuxcare.clsa:obj:1790590713002"/>
      <red-def:state state_ref="oval:com.tuxcare.clsa:ste:1790590713003"/>
    </red-def:rpminfo_test>
    <red-def:rpminfo_test check="none satisfy" comment="openexr isn't signed with TuxCare key" id="oval:com.tuxcare.clsa:tst:1790590713004" version="1">
      <red-def:object object_ref="oval:com.tuxcare.clsa:obj:1790590713002"/>
      <red-def:state state_ref="oval:com.tuxcare.clsa:ste:1790590713004"/>
    </red-def:rpminfo_test>
    <red-def:rpminfo_test check="at least one" comment="openexr-devel is earlier than 0:3.1.1-3.el9_8.4.tuxcare.els1" id="oval:com.tuxcare.clsa:tst:1790590713005" version="1">
      <red-def:object object_ref="oval:com.tuxcare.clsa:obj:1790590713005"/>
      <red-def:state state_ref="oval:com.tuxcare.clsa:ste:1790590713002"/>
    </red-def:rpminfo_test>
    <red-def:rpminfo_test check="none satisfy" comment="openexr-devel isn't signed with TuxCare 9.8 key" id="oval:com.tuxcare.clsa:tst:1790590713006" version="1">
      <red-def:object object_ref="oval:com.tuxcare.clsa:obj:1790590713005"/>
      <red-def:state state_ref="oval:com.tuxcare.clsa:ste:1790590713003"/>
    </red-def:rpminfo_test>
    <red-def:rpminfo_test check="none satisfy" comment="openexr-devel isn't signed with TuxCare key" id="oval:com.tuxcare.clsa:tst:1790590713007" version="1">
      <red-def:object object_ref="oval:com.tuxcare.clsa:obj:1790590713005"/>
      <red-def:state state_ref="oval:com.tuxcare.clsa:ste:1790590713004"/>
    </red-def:rpminfo_test>
    <red-def:rpminfo_test check="at least one" comment="openexr-libs is earlier than 0:3.1.1-3.el9_8.4.tuxcare.els1" id="oval:com.tuxcare.clsa:tst:1790590713008" version="1">
      <red-def:object object_ref="oval:com.tuxcare.clsa:obj:1790590713008"/>
      <red-def:state state_ref="oval:com.tuxcare.clsa:ste:1790590713002"/>
    </red-def:rpminfo_test>
    <red-def:rpminfo_test check="none satisfy" comment="openexr-libs isn't signed with TuxCare 9.8 key" id="oval:com.tuxcare.clsa:tst:1790590713009" version="1">
      <red-def:object object_ref="oval:com.tuxcare.clsa:obj:1790590713008"/>
      <red-def:state state_ref="oval:com.tuxcare.clsa:ste:1790590713003"/>
    </red-def:rpminfo_test>
    <red-def:rpminfo_test check="none satisfy" comment="openexr-libs isn't signed with TuxCare key" id="oval:com.tuxcare.clsa:tst:1790590713010" version="1">
      <red-def:object object_ref="oval:com.tuxcare.clsa:obj:1790590713008"/>
      <red-def:state state_ref="oval:com.tuxcare.clsa:ste:1790590713004"/>
    </red-def:rpminfo_test>
  </tests>
  <objects>
    <ind-def:textfilecontent54_object id="oval:com.tuxcare.clsa:obj:1790590713001" version="1">
      <ind-def:filepath datatype="string">/etc/tuxcare-release</ind-def:filepath>
      <ind-def:pattern operation="pattern match">TuxCare Enterprise Support for .* release 9\.8</ind-def:pattern>
      <ind-def:instance datatype="int">1</ind-def:instance>
    </ind-def:textfilecontent54_object>
    <red-def:rpminfo_object id="oval:com.tuxcare.clsa:obj:1790590713002" version="1">
      <red-def:name>openexr</red-def:name>
    </red-def:rpminfo_object>
    <red-def:rpminfo_object id="oval:com.tuxcare.clsa:obj:1790590713005" version="1">
      <red-def:name>openexr-devel</red-def:name>
    </red-def:rpminfo_object>
    <red-def:rpminfo_object id="oval:com.tuxcare.clsa:obj:1790590713008" version="1">
      <red-def:name>openexr-libs</red-def:name>
    </red-def:rpminfo_object>
  </objects>
  <states>
    <red-def:rpminfo_state id="oval:com.tuxcare.clsa:ste:1790590713002" version="1">
      <red-def:arch datatype="string" operation="pattern match">aarch64|i686|x86_64</red-def:arch>
      <red-def:evr datatype="evr_string" operation="less than">0:3.1.1-3.el9_8.4.tuxcare.els1</red-def:evr>
    </red-def:rpminfo_state>
    <red-def:rpminfo_state id="oval:com.tuxcare.clsa:ste:1790590713003" version="1">
      <red-def:signature_keyid operation="equals">D36CB86CB86B3716</red-def:signature_keyid>
    </red-def:rpminfo_state>
    <red-def:rpminfo_state id="oval:com.tuxcare.clsa:ste:1790590713004" version="1">
      <red-def:signature_keyid operation="equals">d07bf2a08d50eb66</red-def:signature_keyid>
    </red-def:rpminfo_state>
  </states>
</oval_definitions>
