*** This bug is a security vulnerability *** Public security bug reported:
A heap-based buffer overflow was found in the way OpenJPEG, an open-source JPEG 2000 codec written in C language, performed parsing of JPEG2000 having certain number of tiles and tilesizes. A remote attacker could provide a specially crafted JPEG 2000 file, which when opened in an application linked against openjpeg would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application. Upstream patch: http://code.google.com/p/openjpeg/source/detail?r=1727 References: https://bugzilla.redhat.com/show_bug.cgi?id=835767 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681075 This issue has been assigned CVE-2012-3358 ** Affects: openjpeg (Ubuntu) Importance: Undecided Status: New ** Affects: openjpeg (Debian) Importance: Unknown Status: Unknown ** Affects: openjpeg (Fedora) Importance: Unknown Status: Unknown ** Bug watch added: Debian Bug tracker #681075 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681075 ** Also affects: openjpeg (Debian) via http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681075 Importance: Unknown Status: Unknown ** Bug watch added: Red Hat Bugzilla #835767 https://bugzilla.redhat.com/show_bug.cgi?id=835767 ** Also affects: openjpeg (Fedora) via https://bugzilla.redhat.com/show_bug.cgi?id=835767 Importance: Unknown Status: Unknown ** CVE added: http://www.cve.mitre.org/cgi- bin/cvename.cgi?name=2012-3358 ** Visibility changed to: Public -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1023259 Title: (CVE-2012-3358) CVE-2012-3358 openjpeg: heap-based buffer overflow when processing JPEG2000 image files To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/openjpeg/+bug/1023259/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
