Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

Red Hat: RHSA-2017:0838-01 Moderate: OpenJPEG Buffer Overflow Issues

red hat
Calendar Grey March 23, 2017
Scroller Redhat
Keep your Red Hat Enterprise Linux well-protected by applying the recent OpenJPEG security patch that resolves various security flaws.
An update for openjpeg is now available for Red Hat Enterprise Linux 7

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications using OpenJPEG must be restarted for the update to take effect.

Summary

OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.
Security Fix(es):
* Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potentially, execute arbitrary code. (CVE-2016-5139, CVE-2016-5158, CVE-2016-5159, CVE-2016-7163)
* An out-of-bounds read vulnerability was found in OpenJPEG, in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap. (CVE-2016-9573)
* A heap-based buffer overflow vulnerability was found in OpenJPEG. A specially crafted JPEG2000 image, when read by an application using OpenJPEG, could cause the application to crash or, potentially, execute arbitrary code. (CVE-2016-9675)
Red Hat would like to thank Liu Bingchang (IIE) for reporting CVE-2016-9573. The CVE-2016-9675 issue was discovered by Doran Moppert (Red Hat Product Security).

Topics%20covered

Topics Covered

security advisory moderate security issue buffer overflow heap overflow red hat enterprise openjpeg

References

https://access.redhat.com/security/cve/CVE-2016-5139 https://access.redhat.com/security/cve/CVE-2016-5158 https://access.redhat.com/security/cve/CVE-2016-5159 https://access.redhat.com/security/cve/CVE-2016-7163 https://access.redhat.com/security/cve/CVE-2016-9573 https://access.redhat.com/security/cve/CVE-2016-9675 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat Enterprise Linux Client (v. 7):
Source: openjpeg-1.5.1-16.el7_3.src.rpm
x86_64: openjpeg-debuginfo-1.5.1-16.el7_3.i686.rpm openjpeg-debuginfo-1.5.1-16.el7_3.x86_64.rpm openjpeg-libs-1.5.1-16.el7_3.i686.rpm openjpeg-libs-1.5.1-16.el7_3.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: openjpeg-1.5.1-16.el7_3.x86_64.rpm openjpeg-debuginfo-1.5.1-16.el7_3.i686.rpm openjpeg-debuginfo-1.5.1-16.el7_3.x86_64.rpm openjpeg-devel-1.5.1-16.el7_3.i686.rpm openjpeg-devel-1.5.1-16.el7_3.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source: openjpeg-1.5.1-16.el7_3.src.rpm
x86_64: openjpeg-debuginfo-1.5.1-16.el7_3.i686.rpm openjpeg-debuginfo-1.5.1-16.el7_3.x86_64.rpm openjpeg-libs-1.5.1-16.el7_3.i686.rpm openjpeg-libs-1.5.1-16.el7_3.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64: openjpeg-1.5.1-16.el7_3.x86_64.rpm openjpeg-debuginfo-1.5.1-16.el7_3.i686.rpm openjpeg-debuginfo-1.5.1-16.el7_3.x86_64.rpm openjpeg-devel-1.5.1-16.el7_3.i686.rpm openjpeg-devel-1.5.1-16.el7_3.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: openjpeg-1.5.1-16.el7_3.src.rpm
aarch64: openjpeg-debuginfo-1.5.1-16.el7_3.aarch64.rpm openjpeg-libs-1.5.1-16.el7_3.aarch64.rpm
ppc64: openjpeg-debuginfo-1.5.1-16.el7_3.ppc.rpm

Read the Full Advisory


Advisory ID: RHSA-2017:0838-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2017:0838.html
Issue date: 2017-03-23

Topic

An update for openjpeg is now available for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security issue buffer overflow heap overflow red hat enterprise openjpeg

Relevant Releases Architectures

Red Hat Enterprise Linux Client (v. 7) - x86_64

Red Hat Enterprise Linux Client Optional (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64

Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64

Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 7) - x86_64

Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

Bugs Fixed

1363982 - CVE-2016-5139 chromium-browser, openjpeg: Heap overflow in parsing of JPEG2000 precincts

1372219 - CVE-2016-5158 chromium-browser, openjpeg: heap overflow due to unsafe use of opj_aligned_malloc

1372220 - CVE-2016-5159 chromium-browser, openjpeg: heap overflow in parsing of JPEG2000 code blocks

1374329 - CVE-2016-7163 openjpeg: Integer overflow in opj_pi_create_decode

1382202 - CVE-2016-9675 openjpeg: incorrect fix for CVE-2013-6045

1402711 - CVE-2016-9573 openjpeg: heap out-of-bounds read due to insufficient check in imagetopnm()

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.