(CVE-2012-3358) CVE-2012-3358 openjpeg: heap-based buffer overflow when processing JPEG2000 image files

[Karma Dorje]

A heap-based buffer overflow was found in the way OpenJPEG, an
open-source JPEG 2000 codec written in C language, performed parsing of
JPEG2000 having certain number of tiles and tilesizes. A remote
attacker could provide a specially crafted JPEG 2000 file, which when
opened in an application linked against openjpeg would lead to that
application crash, or, potentially arbitrary code execution with the
privileges of the user running the application.

Upstream patch:
http://code.google.com/p/openjpeg/source/detail?r=1727

References:
https://bugzilla.redhat.com/show_bug.cgi?id=835767
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681075

This issue has been assigned CVE-2012-3358

[Huzaifa (huzaifa-redhat-bugs)]

A heap-based buffer overflow was found in the way OpenJPEG, an open-source JPEG 2000 codec written in C language, performed parsing of JPEG2000 having certain number of tiles and tilesizes. A remote attacker could provide a specially crafted JPEG 2000 file, which when opened in an application linked against openjpeg would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.

[Tom (tom-redhat-bugs)]

Created attachment 594684
openjpeg-tile-sanity.patch

Um, this is the relevant patch, not that one.

[Vincent (vincent-redhat-bugs)]

This is now public:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681075

[Huzaifa (huzaifa-redhat-bugs)]

Here is the upstream commit:

http://code.google.com/p/openjpeg/source/detail?r=1727

[Huzaifa (huzaifa-redhat-bugs)]

Created openjpeg tracking bugs for this issue

Affects: fedora-all [bug 839125]

[errata-xmlrpc (errata-xmlrpc-redhat-bugs)]

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1068 https://rhn.redhat.com/errata/RHSA-2012-1068.html

[Jamie Strandboge (jdstrand)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Jamie Strandboge (jdstrand)]

This was fixed in 1.3+dfsg-4.4