[<prev] [next>] [day] [month] [year] [list]
Message-ID: <4FFCF55E.6020603@redhat.com>
Date: Wed, 11 Jul 2012 09:09:10 +0530
From: Huzaifa Sidhpurwala <huzaifas@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Openjpeg: heap-buffer overflow when processing JPEG2000 image files
Hi All,
We have found a heap-buffer overflow in openjpeg, details are as
follows:
Description:
A heap-based buffer overflow was found in the way OpenJPEG, an
open-source JPEG 2000 codec written in C language, performed parsing of
JPEG2000 having certain number of tiles and tilesizes. A remote
attacker could provide a specially crafted JPEG 2000 file, which when
opened in an application linked against openjpeg would lead to that
application crash, or, potentially arbitrary code execution with the
privileges of the user running the application.
Upstream patch:
http://code.google.com/p/openjpeg/source/detail?r=1727
References:
https://bugzilla.redhat.com/show_bug.cgi?id=835767
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681075
This issue has been assigned CVE-2012-3358
--
Huzaifa Sidhpurwala / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
