- -------------------------------------------------------------------------
Debian Security Advisory DSA-4405-1                   security@debian.org
https://www.debian.org/security/                            Luciano Bello
March 10, 2019                        https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : openjpeg2
CVE ID         : CVE-2017-17480 CVE-2018-5785 CVE-2018-6616 CVE-2018-14423 
                 CVE-2018-18088
Debian Bug     : 884738 888533 889683 904873 910763

Multiple vulnerabilities have been discovered in openjpeg2, the
open-source JPEG 2000 codec, that could be leveraged to cause a denial
of service or possibly remote code execution.

CVE-2017-17480

    Write stack buffer overflow in the jp3d and jpwl codecs can result
    in a denial of service or remote code execution via a crafted jp3d
    or jpwl file.

CVE-2018-5785

    Integer overflow can result in a denial of service via a crafted bmp
    file.

CVE-2018-6616

    Excessive iteration can result in a denial of service via a crafted
    bmp file.

CVE-2018-14423

    Division-by-zero vulnerabilities can result in a denial of service via
    a crafted j2k file.

CVE-2018-18088

    Null pointer dereference can result in a denial of service via a
    crafted bmp file.


For the stable distribution (stretch), these problems have been fixed in
version 2.1.2-1.1+deb9u3.

We recommend that you upgrade your openjpeg2 packages.

For the detailed security status of openjpeg2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/openjpeg2

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org

Debian: DSA-4405-1: openjpeg2 security update

March 10, 2019
Multiple vulnerabilities have been discovered in openjpeg2, the open-source JPEG 2000 codec, that could be leveraged to cause a denial of service or possibly remote code execution

Summary

CVE-2017-17480

Write stack buffer overflow in the jp3d and jpwl codecs can result
in a denial of service or remote code execution via a crafted jp3d
or jpwl file.

CVE-2018-5785

Integer overflow can result in a denial of service via a crafted bmp
file.

CVE-2018-6616

Excessive iteration can result in a denial of service via a crafted
bmp file.

CVE-2018-14423

Division-by-zero vulnerabilities can result in a denial of service via
a crafted j2k file.

CVE-2018-18088

Null pointer dereference can result in a denial of service via a
crafted bmp file.


For the stable distribution (stretch), these problems have been fixed in
version 2.1.2-1.1+deb9u3.

We recommend that you upgrade your openjpeg2 packages.

For the detailed security status of openjpeg2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/openjpeg2

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org

Severity
Multiple vulnerabilities have been discovered in openjpeg2, the
open-source JPEG 2000 codec, that could be leveraged to cause a denial
of service or possibly remote code execution.

Related News

2.Motherboard Esm H320
2 - 3 min read
German software engineer Lennart Poettering recently presented run0 , a new tool in systemd v256 that aims to address the security concerns
22.Lock ScreenEffect Esm H320
2 - 3 min read
Red Hat recently released its newest enterprise Linux distro, Red Hat Enterprise Linux (RHEL) 9.4 , which introduces several features designed to
8.Locks HexConnections CodeGlobe Esm H320
1 - 2 min read
The latest release of Debian , one of the oldest and most trusted distributions within the Linux ecosystem, redefines security, stability, and
20.Lock AbstractDigital Circular Esm H320
1 - 2 min read
The Ubuntu security team has recently discovered and addressed multiple vulnerabilities in the Apache HTTP Server. The vulnerabilities affected
1.Penguin Landscape Esm H320
1 - 2 min read
A critical vulnerability was discovered in the Linux kernel's netfilter subsystem, specifically within the nf_tables component, posing potential
19.Laptop Bed Esm H320
2 - 3 min read
The release of Google Chrome 124 addresses four vulnerabilities, including a critical security flaw that can enable attackers to execute arbitrary
23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
Sign Up