Ubuntu
openjpeg package

Fix for CVE-2013-6045 breaks decoding of chroma-subsampled images

Bug #1404084 reported by Benjamin Gilbert
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
openjpeg (Debian)
Fix Released
Unknown
openjpeg (Ubuntu)
Won't Fix
Medium
Unassigned

Bug Description

The patch for CVE-2013-6045, as shipped in Ubuntu 10.04, 12.04, and 14.04, disables decoding of images whose first
color component has a higher resolution than subsequent components. This occurs, for example, in YCbCr images with chroma subsampling. This regression does not affect newer Ubuntu releases which ship OpenJPEG 1.5.2 or above.

The original Debian bug report is <https://bugs.debian.org/734238>. Debian released an updated DSA on April 22 to correct the regression (https://lists.debian.org/debian-security-announce/2014/msg00090.html), but the fix has not propagated to Ubuntu.

Mathew Hodson (mhodson)
tags: added: regression-update trusty
tags: added: precise
Changed in openjpeg (Ubuntu):
importance: Undecided → Medium
Bug Watch Updater (bug-watch-updater)
Changed in openjpeg (Debian):
status: Unknown → Fix Released
Mathew Hodson (mhodson)
information type: Public → Public Security
Marc Deslauriers (mdeslaur)
Changed in openjpeg (Ubuntu):
status: New → Won't Fix
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.