Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

RHEL 6: RHSA-2017:0559-01 Moderate: OpenJPEG Buffer Overflow Issue

red hat
Calendar Grey March 20, 2017
Scroller Redhat
Significant openjpeg upgrade released for Red Hat Enterprise Linux 6 rectifying various buffer overflow vulnerabilities.
An update for openjpeg is now available for Red Hat Enterprise Linux 6

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications using OpenJPEG must be restarted for the update to take effect.

Summary

OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.
Security Fix(es):
* Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potentially, execute arbitrary code. (CVE-2016-5139, CVE-2016-5158, CVE-2016-5159, CVE-2016-7163)
* A vulnerability was found in the patch for CVE-2013-6045 for OpenJPEG. A specially crafted JPEG2000 image, when read by an application using OpenJPEG, could cause heap-based buffer overflows leading to a crash or, potentially, arbitrary code execution. (CVE-2016-9675)
The CVE-2016-9675 issue was discovered by Doran Moppert (Red Hat Product Security).

Topics%20covered

Topics Covered

security advisory moderate security update buffer overflow red hat application crash openjpeg

References

https://access.redhat.com/security/cve/CVE-2016-5139 https://access.redhat.com/security/cve/CVE-2016-5158 https://access.redhat.com/security/cve/CVE-2016-5159 https://access.redhat.com/security/cve/CVE-2016-7163 https://access.redhat.com/security/cve/CVE-2016-9675 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat Enterprise Linux Desktop (v. 6):
Source: openjpeg-1.3-16.el6_8.src.rpm
i386: openjpeg-debuginfo-1.3-16.el6_8.i686.rpm openjpeg-libs-1.3-16.el6_8.i686.rpm
x86_64: openjpeg-debuginfo-1.3-16.el6_8.i686.rpm openjpeg-debuginfo-1.3-16.el6_8.x86_64.rpm openjpeg-libs-1.3-16.el6_8.i686.rpm openjpeg-libs-1.3-16.el6_8.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
i386: openjpeg-1.3-16.el6_8.i686.rpm openjpeg-debuginfo-1.3-16.el6_8.i686.rpm openjpeg-devel-1.3-16.el6_8.i686.rpm
x86_64: openjpeg-1.3-16.el6_8.x86_64.rpm openjpeg-debuginfo-1.3-16.el6_8.i686.rpm openjpeg-debuginfo-1.3-16.el6_8.x86_64.rpm openjpeg-devel-1.3-16.el6_8.i686.rpm openjpeg-devel-1.3-16.el6_8.x86_64.rpm
Red Hat Enterprise Linux HPC Node (v. 6):
Source: openjpeg-1.3-16.el6_8.src.rpm
x86_64: openjpeg-debuginfo-1.3-16.el6_8.i686.rpm openjpeg-debuginfo-1.3-16.el6_8.x86_64.rpm openjpeg-libs-1.3-16.el6_8.i686.rpm openjpeg-libs-1.3-16.el6_8.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
x86_64: openjpeg-1.3-16.el6_8.x86_64.rpm openjpeg-debuginfo-1.3-16.el6_8.i686.rpm openjpeg-debuginfo-1.3-16.el6_8.x86_64.rpm openjpeg-devel-1.3-16.el6_8.i686.rpm openjpeg-devel-1.3-16.el6_8.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source: openjpeg-1.3-16.el6_8.src.rpm
i386:

Read the Full Advisory


Advisory ID: RHSA-2017:0559-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2017:0559.html
Issue date: 2017-03-19

Topic

An update for openjpeg is now available for Red Hat Enterprise Linux 6.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security update buffer overflow red hat application crash openjpeg

Relevant Releases Architectures

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64

Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64

Red Hat Enterprise Linux HPC Node (v. 6) - x86_64

Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64

Bugs Fixed

1363982 - CVE-2016-5139 chromium-browser, openjpeg: Heap overflow in parsing of JPEG2000 precincts

1372219 - CVE-2016-5158 chromium-browser, openjpeg: heap overflow due to unsafe use of opj_aligned_malloc

1372220 - CVE-2016-5159 chromium-browser, openjpeg: heap overflow in parsing of JPEG2000 code blocks

1374329 - CVE-2016-7163 openjpeg: Integer overflow in opj_pi_create_decode

1382202 - CVE-2016-9675 openjpeg: incorrect fix for CVE-2013-6045

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.