Date: Wed, 11 Jul 2012 09:09:10 +0530 From: Huzaifa Sidhpurwala <huzaifas@...hat.com> To: oss-security@...ts.openwall.com Subject: Openjpeg: heap-buffer overflow when processing JPEG2000 image files Hi All, We have found a heap-buffer overflow in openjpeg, details are as follows: Description: A heap-based buffer overflow was found in the way OpenJPEG, an open-source JPEG 2000 codec written in C language, performed parsing of JPEG2000 having certain number of tiles and tilesizes. A remote attacker could provide a specially crafted JPEG 2000 file, which when opened in an application linked against openjpeg would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application. Upstream patch: http://code.google.com/p/openjpeg/source/detail?r=1727 References: https://bugzilla.redhat.com/show_bug.cgi?id=835767 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681075 This issue has been assigned CVE-2012-3358 -- Huzaifa Sidhpurwala / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.