{"id": "CVE-2016-8332", "bulletinFamily": "NVD", "title": "CVE-2016-8332", "description": "A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. An exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful attack, the target user needs to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents and the OpenJpeg library is used by a number of popular PDF renderers making PDF documents a likely attack vector.", "published": "2016-10-28T14:59:00", "modified": "2017-11-04T01:29:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8332", "reporter": "cve@mitre.org", "references": ["http://www.securityfocus.com/bid/93242", "http://www.talosintelligence.com/reports/TALOS-2016-0193/", "http://www.securitytracker.com/id/1038623", "https://github.com/uclouvain/openjpeg/releases/tag/v2.1.2", "http://www.debian.org/security/2017/dsa-3768"], "cvelist": ["CVE-2016-8332"], "type": "cve", "lastseen": "2019-05-29T18:15:40", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "46be7a1168d0c48497204551a703b47d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "dfc01a3fb99f445e6ff4c8776797ffbf"}, {"key": "cpe23", "hash": "b5aa304d799c504ac36c041587be2973"}, {"key": "cvelist", "hash": "3bd30b98fb564cb66e95147d1b73c89f"}, {"key": "cvss", "hash": "4cac367be6dd8242802053610be9dee6"}, {"key": "cvss2", "hash": "ed680418e7920255a42996cf5fef98da"}, {"key": "cvss3", "hash": "26f338b95fa1d6f598ba1e3d1ba2ee53"}, {"key": "cwe", "hash": "bb61a0949f8c36262500079f243672e2"}, {"key": "description", "hash": "6eaf4cddf478f68d08b840d084a0d464"}, {"key": "href", "hash": "990c16862780f21bb5cba5eb4321eea2"}, {"key": "modified", "hash": "0bf9a7d4ff703f4ec5a6bf99b1736025"}, {"key": "published", "hash": "02af49cf870ff29f75c3fd32c7671445"}, {"key": "references", "hash": "9944da0933629c010ed818d4c381dcf3"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "7bd1d1ed857c1156013a35c2e7bb3060"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "bca26a035ca2cca607bcb980c5ca4775e7469748c67804e9be9d0fc157c7628c", "viewCount": 0, "enchantments": {"score": {"value": 6.0, "vector": "NONE", "modified": "2019-05-29T18:15:40"}, "dependencies": {"references": [{"type": "seebug", "idList": ["SSV:96672"]}, {"type": "thn", "idList": ["THN:1C6DD059E76C91837FE072F66F0C7360"]}, {"type": "talos", "idList": ["TALOS-2016-0193"]}, {"type": "nessus", "idList": ["DEBIAN_DSA-3768.NASL", "SUSE_SU-2016-3270-1.NASL", "OPENSUSE-2017-101.NASL", "OPENSUSE-2017-120.NASL", "OPENSUSE-2017-108.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310703768", "OPENVAS:703768", "OPENVAS:1361412562310851480", "OPENVAS:1361412562310851510", "OPENVAS:1361412562310851478"]}, {"type": "debian", "idList": ["DEBIAN:DSA-3678-1:F57E2"]}, {"type": "suse", "idList": ["SUSE-SU-2016:3270-1", "OPENSUSE-SU-2017:0155-1", "OPENSUSE-SU-2017:0207-1", "OPENSUSE-SU-2017:0185-1", "OPENSUSE-SU-2017:2567-1"]}], "modified": "2019-05-29T18:15:40"}, "vulnersScore": 6.0}, "objectVersion": "1.3", "cpe": ["cpe:/a:openjpeg:openjpeg:2.1.1"], "affectedSoftware": [{"name": "openjpeg openjpeg", "operator": "eq", "version": "2.1.1"}], "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true}, "cvss3": {"cvssV3": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9}, "cpe23": ["cpe:2.3:a:openjpeg:openjpeg:2.1.1:*:*:*:*:*:*:*"], "cwe": ["CWE-119"]}

{"seebug": [{"lastseen": "2017-11-19T11:56:27", "bulletinFamily": "exploit", "description": "### Summary\r\nAn exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful attack, the target user needs to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents and the OpenJpeg library is used by a number of popular PDF renderers making PDF documents a likely attack vector.\r\n\r\n### Tested Versions\r\nOpenJpeg openjp2 2.1.1\r\n\r\n### Product URLs\r\nhttp://www.openjpeg.org/\r\n\r\n### CVSSv3 Score\r\n7.5 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\r\n\r\n### Details\r\nThe OpenJpeg library is a reference implementation of JPEG2000 standard and is used by many popular PDF renderers. Most notably Poppler, MuPDF and Pdfium.\r\n\r\nDue to an error while parsing `mcc` records in the jpeg2000 file, out of bounds memory can be accessed resulting in an erroneous read and write of adjacent heap area memory. Careful manipulation of heap layout and can lead to further heap metadata process memory corruption ultimately leading to code execution under attacker control.\r\n\r\nThe vulnerability lies in `opj_j2k_read_mcc_record` function in `src/lib/openjp2/j2k.c` file which is responsible for parsing `mcc` records.\r\n```\r\n l_mcc_record = l_tcp->m_mcc_records;\r\n\r\n for(i=0;i<l_tcp->m_nb_mcc_records;++i) {\r\n if (l_mcc_record->m_index == l_indix) {\r\n break;\r\n }\r\n ++l_mcc_record;\r\n }\r\n```\r\nWhen an `mcc` record is being parsed, a `l_mcc_recprd` array is being iterated over in search of appropriate index. Next, if the index is not found, the following code is executed:\r\n```\r\n if (i == l_tcp->m_nb_mcc_records) {\r\n if (l_tcp->m_nb_mcc_records == l_tcp->m_nb_max_mcc_records) {\r\n opj_simple_mcc_decorrelation_data_t *new_mcc_records;\r\n l_tcp->m_nb_max_mcc_records += OPJ_J2K_MCC_DEFAULT_NB_RECORDS;\r\n\r\n new_mcc_records = (opj_simple_mcc_decorrelation_data_t *) opj_realloc(\r\n l_tcp->m_mcc_records, l_tcp->m_nb_max_mcc_records * sizeof(opj_simple_mcc_decorrelation_data_t));\r\n if (! new_mcc_records) {\r\n opj_free(l_tcp->m_mcc_records);\r\n l_tcp->m_mcc_records = NULL;\r\n l_tcp->m_nb_max_mcc_records = 0;\r\n l_tcp->m_nb_mcc_records = 0;\r\n opj_event_msg(p_manager, EVT_ERROR, \"Not enough memory to read MCC marker\\n\");\r\n return OPJ_FALSE;\r\n }\r\n l_tcp->m_mcc_records = new_mcc_records;\r\n l_mcc_record = l_tcp->m_mcc_records + l_tcp->m_nb_mcc_records;\r\n memset(l_mcc_record,0,(l_tcp->m_nb_max_mcc_records-l_tcp->m_nb_mcc_records) * sizeof(opj_simple_mcc_decorrelation_data_t));\r\n }\r\n l_mcc_record = l_tcp->m_mcc_records + l_tcp->m_nb_mcc_records;\r\n }\r\n l_mcc_record->m_index = l_indix;\r\n```\r\nThe first if statement is entered if the index was not found, then, if current number of records has reached a maximum of `l_tcp->m_nb_max_mcc_records` (which is 10 initially), maximum is increased and memory is reallocated to accommodate more records. At the end of the function, number of records is increased:\r\n```\r\n ++l_tcp->m_nb_mcc_records;\r\n return OPJ_TRUE;\r\n```\r\nThe vulnerability in the above code lies in the improper increment of the number of records at the end of the function. If a malicious image is created, such that it has a number of `mcc` records with the same (zero) index, the counter in the for loop can never reach the value that would satisfy `i == l_tcp->m_nb_mcc_records` condition. If there are 10 or more such objects, `l_tcp->m_nb_mcc_records` will be increased to more than `l_tcp->m_nb_max_mcc_records` without actually reallocating the appropriate amount of memory. If then there is an mcc record with a different index in the image, the if condition inside the for loop won\u2019t ever be true, which will lead to `l_mcc_record` pointer being increased out of bounds, causing an out of bounds read. Further on, this out of bounds pointer is retained and is used in a write operation when its index is being updated by a controlled value.\r\n\r\nBy varying the number of mcc records, an attacker can target a particular heap memory area and by abusing the same bug multiple times gain enough control over the process memory to get arbitrary code execution.\r\n\r\n### Crash Information\r\n```\r\n bash-4.3$ valgrind $opj_decompress -i minimal.jp2 -o dasd.bmp\r\n ==13197== Memcheck, a memory error detector\r\n ==13197== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.\r\n ==13197== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info\r\n ==13197== Command:../openjpeg/build/bin/opj_decompress -i minimal.jp2 -o dasd.bmp\r\n ==13197==\r\n\r\n [INFO] Start to read j2k main header (119).\r\n\r\n ==13197== Invalid read of size 4\r\n ==13197== at 0x4049768: opj_j2k_read_mcc (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x404DACA: opj_j2k_read_header_procedure (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x404DDB4: opj_j2k_exec (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x404CB01: opj_j2k_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x405A97C: opj_jp2_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x405CD75: opj_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x804C3E9: main (in../openjpeg/build/bin/opj_decompress)\r\n ==13197== Address 0x4439080 is 0 bytes after a block of size 200 alloc'd\r\n ==13197== at 0x402CEBA: calloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)\r\n ==13197== by 0x406D4C2: opj_calloc (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x40436B6: opj_j2k_read_siz (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x404DACA: opj_j2k_read_header_procedure (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x404DDB4: opj_j2k_exec (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x404CB01: opj_j2k_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x405A97C: opj_jp2_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x405CD75: opj_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x804C3E9: main (in../openjpeg/build/bin/opj_decompress)\r\n ==13197==\r\n ==13197== Invalid write of size 4\r\n ==13197== at 0x4049940: opj_j2k_read_mcc (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x404DACA: opj_j2k_read_header_procedure (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x404DDB4: opj_j2k_exec (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x404CB01: opj_j2k_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x405A97C: opj_jp2_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x405CD75: opj_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\r\n ==13197== by 0x804C3E9: main (in../openjpeg/build/bin/opj_decompress)\r\n ==13197== Address 0x4439094 is 20 bytes after a block of size 200 in arena \"client\"\r\n ==13197==\r\n [ERROR] Error reading MCC marker\r\n [ERROR] Marker handler function failed to read the marker segment\r\n```\r\nIn the above Valgrind output, an invalid out of bounds read and write is recorded.\r\n\r\n### Timeline\r\n* 2016-07-26 - Vendor Disclosure\r\n* 2016-09-29 - Public Release", "modified": "2017-10-13T00:00:00", "published": "2017-10-13T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-96672", "id": "SSV:96672", "type": "seebug", "title": "OpenJPEG JPEG2000 mcc record Code Execution Vulnerability(CVE-2016-8332)", "sourceData": "", "sourceHref": "", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "thn": [{"lastseen": "2018-01-27T10:06:47", "bulletinFamily": "info", "description": "[](<https://4.bp.blogspot.com/-wyaskRjjtUE/V_NxoSzDcuI/AAAAAAAApq8/zzsFrBsA8Fk4m6ZJdNixirFyuPgssqcTwCLcB/s1600/openjpeg-exploit-hack.png>)\n\nResearchers have disclosed a critical zero-day vulnerability in the JPEG 2000 image file format parser implemented in [OpenJPEG library](<http://www.openjpeg.org/>), which could allow an attacker to remotely execute arbitrary code on the affected systems. \n \nDiscovered by security researchers at Cisco Talos group, the zero-day flaw, assigned as TALOS-2016-0193/[CVE-2016-8332](<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8332>), could allow an out-of-bound heap write to occur that triggers the heap corruption and leads to arbitrary code execution. \n \nOpenJPEG is an open-source JPEG 2000 codec. Written in C language, the software was developed for coding and encoding JPEG2000 images, a format that is often used for tasks like embedding image files within PDF documents through popular software including PdFium, Poppler, and MuPDF. \n \nHackers can exploit the security vulnerability by tricking the victim into opening a specially crafted, malicious JPEG2000 image or a PDF document containing that malicious file in an email. \n \nThe hacker could even upload the malicious JPEG2000 image file to a file hosting service, like Dropbox or Google Drive, and then send that link to the victim. \n \nOnce downloaded to the system, it would create a way for hackers to remotely execute malicious code on the affected system. \n \nThe flaw was caused \"_due to an error while parsing mcc records in the jpeg2000 file,...resulting in an erroneous read and write of adjacent heap area memory_,\" Cisco explained in its [advisory](<http://blog.talosintel.com/2016/09/vulnerability-spotlight-jpeg2000.html>). \n \n\"_Careful manipulation of heap layout and can lead to further heap metadata process memory corruption ultimately leading to code execution under attacker control._\" \n \nThe researchers successfully tested the JPEG 2000 image exploit on the OpenJPEG openjp2 version 2.1.1. The flaw was discovered by Aleksandar Nikolic from the Cisco Talos Security team. \n \nThe team reported the zero-day flaw to OpenJPEG developers in late July, and the company patched the flaw last week with the [release of version 2.1.2](<http://www.openjpeg.org/2016/09/28/OpenJPEG-2.1.2-released>). \n \nThe vulnerability has been assigned a CVSS score of 7.5, categorizing it as a high-severity bug.\n", "modified": "2016-10-04T09:23:48", "published": "2016-10-03T22:23:00", "id": "THN:1C6DD059E76C91837FE072F66F0C7360", "href": "https://thehackernews.com/2016/10/openjpeg-exploit-hack.html", "type": "thn", "title": "Beware! You Can Get Hacked Just by Opening a 'JPEG 2000' Image", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "talos": [{"lastseen": "2019-05-29T19:19:52", "bulletinFamily": "info", "description": "# Talos Vulnerability Report\n\n### TALOS-2016-0193\n\n## OpenJPEG JPEG2000 mcc record Code Execution Vulnerability\n\n##### September 29, 2016\n\n##### CVE Number\n\nCVE-2016-8332\n\n### Summary\n\nAn exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful attack, the target user needs to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents and the OpenJpeg library is used by a number of popular PDF renderers making PDF documents a likely attack vector.\n\n### Tested Versions\n\nOpenJpeg openjp2 2.1.1\n\n### Product URLs\n\n<http://www.openjpeg.org/>\n\n### CVSSv3 Score\n\n7.5 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H\n\n### Details\n\nThe OpenJpeg library is a reference implementation of JPEG2000 standard and is used by many popular PDF renderers. Most notably Poppler, MuPDF and Pdfium.\n\nDue to an error while parsing `mcc` records in the jpeg2000 file, out of bounds memory can be accessed resulting in an erroneous read and write of adjacent heap area memory. Careful manipulation of heap layout and can lead to further heap metadata process memory corruption ultimately leading to code execution under attacker control.\n\nThe vulnerability lies in `opj_j2k_read_mcc_record` function in `src/lib/openjp2/j2k.c` file which is responsible for parsing `mcc` records.\n \n \n ```\n l_mcc_record = l_tcp->m_mcc_records;\n \n for(i=0;i<l_tcp->m_nb_mcc_records;++i) {\n if (l_mcc_record->m_index == l_indix) {\n break;\n }\n ++l_mcc_record;\n }\n ```\n \n\nWhen an `mcc` record is being parsed, a `l_mcc_recprd` array is being iterated over in search of appropriate index. Next, if the index is not found, the following code is executed:\n \n \n ```\n if (i == l_tcp->m_nb_mcc_records) {\n if (l_tcp->m_nb_mcc_records == l_tcp->m_nb_max_mcc_records) {\n opj_simple_mcc_decorrelation_data_t *new_mcc_records;\n l_tcp->m_nb_max_mcc_records += OPJ_J2K_MCC_DEFAULT_NB_RECORDS;\n \n new_mcc_records = (opj_simple_mcc_decorrelation_data_t *) opj_realloc(\n l_tcp->m_mcc_records, l_tcp->m_nb_max_mcc_records * sizeof(opj_simple_mcc_decorrelation_data_t));\n if (! new_mcc_records) {\n opj_free(l_tcp->m_mcc_records);\n l_tcp->m_mcc_records = NULL;\n l_tcp->m_nb_max_mcc_records = 0;\n l_tcp->m_nb_mcc_records = 0;\n opj_event_msg(p_manager, EVT_ERROR, \"Not enough memory to read MCC marker\\n\");\n return OPJ_FALSE;\n }\n l_tcp->m_mcc_records = new_mcc_records;\n l_mcc_record = l_tcp->m_mcc_records + l_tcp->m_nb_mcc_records;\n memset(l_mcc_record,0,(l_tcp->m_nb_max_mcc_records-l_tcp->m_nb_mcc_records) * sizeof(opj_simple_mcc_decorrelation_data_t));\n }\n l_mcc_record = l_tcp->m_mcc_records + l_tcp->m_nb_mcc_records;\n }\n l_mcc_record->m_index = l_indix;\n ```\n \n\nThe first if statement is entered if the index was not found, then, if current number of records has reached a maximum of `l_tcp->m_nb_max_mcc_records` (which is 10 initially), maximum is increased and memory is reallocated to accommodate more records. At the end of the function, number of records is increased:\n \n \n ```\n ++l_tcp->m_nb_mcc_records;\n return OPJ_TRUE;\n ```\n \n\nThe vulnerability in the above code lies in the improper increment of the number of records at the end of the function. If a malicious image is created, such that it has a number of `mcc` records with the same (zero) index, the counter in the for loop can never reach the value that would satisfy `i == l_tcp->m_nb_mcc_records` condition. If there are 10 or more such objects, `l_tcp->m_nb_mcc_records` will be increased to more than `l_tcp->m_nb_max_mcc_records` without actually reallocating the appropriate amount of memory. If then there is an mcc record with a different index in the image, the if condition inside the for loop won\u2019t ever be true, which will lead to `l_mcc_record` pointer being increased out of bounds, causing an out of bounds read. Further on, this out of bounds pointer is retained and is used in a write operation when its index is being updated by a controlled value.\n\nBy varying the number of mcc records, an attacker can target a particular heap memory area and by abusing the same bug multiple times gain enough control over the process memory to get arbitrary code execution.\n\n### Crash Information\n \n \n ```\n bash-4.3$ valgrind $opj_decompress -i minimal.jp2 -o dasd.bmp\n ==13197== Memcheck, a memory error detector\n ==13197== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.\n ==13197== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info\n ==13197== Command:../openjpeg/build/bin/opj_decompress -i minimal.jp2 -o dasd.bmp\n ==13197==\n \n [INFO] Start to read j2k main header (119).\n \n ==13197== Invalid read of size 4\n ==13197== at 0x4049768: opj_j2k_read_mcc (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x404DACA: opj_j2k_read_header_procedure (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x404DDB4: opj_j2k_exec (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x404CB01: opj_j2k_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x405A97C: opj_jp2_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x405CD75: opj_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x804C3E9: main (in../openjpeg/build/bin/opj_decompress)\n ==13197== Address 0x4439080 is 0 bytes after a block of size 200 alloc'd\n ==13197== at 0x402CEBA: calloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)\n ==13197== by 0x406D4C2: opj_calloc (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x40436B6: opj_j2k_read_siz (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x404DACA: opj_j2k_read_header_procedure (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x404DDB4: opj_j2k_exec (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x404CB01: opj_j2k_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x405A97C: opj_jp2_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x405CD75: opj_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x804C3E9: main (in../openjpeg/build/bin/opj_decompress)\n ==13197==\n ==13197== Invalid write of size 4\n ==13197== at 0x4049940: opj_j2k_read_mcc (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x404DACA: opj_j2k_read_header_procedure (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x404DDB4: opj_j2k_exec (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x404CB01: opj_j2k_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x405A97C: opj_jp2_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x405CD75: opj_read_header (in../openjpeg/build/bin/libopenjp2.so.2.1.1)\n ==13197== by 0x804C3E9: main (in../openjpeg/build/bin/opj_decompress)\n ==13197== Address 0x4439094 is 20 bytes after a block of size 200 in arena \"client\"\n ==13197==\n [ERROR] Error reading MCC marker\n [ERROR] Marker handler function failed to read the marker segment\n ```\n \n\nIn the above Valgrind output, an invalid out of bounds read and write is recorded.\n\n### Timeline\n\n2016-07-26 - Vendor Disclosure \n2016-09-29 - Public Release\n\n##### Credit\n\nDiscovered by Aleksandar Nikolic of Cisco Talos.\n\n* * *\n\nVulnerability Reports Next Report\n\nTALOS-2016-0260\n\nPrevious Report\n\nTALOS-2016-0183\n", "modified": "2016-09-29T00:00:00", "published": "2016-09-29T00:00:00", "id": "TALOS-2016-0193", "href": "http://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0193", "title": "OpenJPEG JPEG2000 mcc record Code Execution Vulnerability", "type": "talos", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2019-02-21T01:29:09", "bulletinFamily": "scanner", "description": "Multiple vulnerabilities in OpenJPEG, a JPEG 2000 image compression / decompression library, may result in denial of service or the execution of arbitrary code if a malformed JPEG 2000 file is processed.", "modified": "2018-11-10T00:00:00", "id": "DEBIAN_DSA-3768.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=96667", "published": "2017-01-23T00:00:00", "title": "Debian DSA-3768-1 : openjpeg2 - security update", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3768. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(96667);\n script_version(\"3.5\");\n script_cvs_date(\"Date: 2018/11/10 11:49:38\");\n\n script_cve_id(\"CVE-2016-5159\", \"CVE-2016-8332\", \"CVE-2016-9572\", \"CVE-2016-9573\");\n script_xref(name:\"DSA\", value:\"3768\");\n\n script_name(english:\"Debian DSA-3768-1 : openjpeg2 - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple vulnerabilities in OpenJPEG, a JPEG 2000 image compression /\ndecompression library, may result in denial of service or the\nexecution of arbitrary code if a malformed JPEG 2000 file is\nprocessed.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/openjpeg2\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2017/dsa-3768\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the openjpeg2 packages.\n\nFor the stable distribution (jessie), these problems have been fixed\nin version 2.1.0-2+deb8u2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:openjpeg2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/01/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/01/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"libopenjp2-7\", reference:\"2.1.0-2+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libopenjp2-7-dbg\", reference:\"2.1.0-2+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libopenjp2-7-dev\", reference:\"2.1.0-2+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libopenjp2-tools\", reference:\"2.1.0-2+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libopenjp3d-tools\", reference:\"2.1.0-2+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libopenjp3d7\", reference:\"2.1.0-2+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libopenjpip-dec-server\", reference:\"2.1.0-2+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libopenjpip-server\", reference:\"2.1.0-2+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libopenjpip-viewer\", reference:\"2.1.0-2+deb8u2\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libopenjpip7\", reference:\"2.1.0-2+deb8u2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:28:54", "bulletinFamily": "scanner", "description": "This update for openjpeg2 fixes the following issues :\n\n - CVE-2016-9114: NULL pointer Access in function imagetopnm of convert.c:1943(jp2) could lead to crash [bsc#1007740]\n\n - CVE-2016-9115: Heap Buffer Overflow in function imagetotga of convert.c(jp2) [bsc#1007741]\n\n - CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer overflow and infite loop [bsc#1014975]\n\n - CVE-2016-9117: NULL pointer Access in function imagetopnm of convert.c(jp2):1289 [bsc#1007743]\n\n - CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c [bsc#1007744]\n\n - CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523 [bsc#1007747]\n\n - CVE-2016-9116: NULL pointer Access in function imagetopnm of convert.c:2226(jp2) [bsc#1007742]\n\n - CVE-2016-9113: NULL point dereference in function imagetobmp of convertbmp.c could lead to crash [bsc#1007739]\n\n - CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could lead to heap buffer overflow [bsc#1014543]\n\n - CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to code execution [bsc#1002414]\n\n - CVE-2016-7445: NULL pointer dereference in convert.c could lead to crash [bsc#999817]\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "modified": "2018-11-30T00:00:00", "id": "SUSE_SU-2016-3270-1.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=96147", "published": "2016-12-27T00:00:00", "title": "SUSE SLED12 / SLES12 Security Update : openjpeg2 (SUSE-SU-2016:3270-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:3270-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(96147);\n script_version(\"3.7\");\n script_cvs_date(\"Date: 2018/11/30 10:54:50\");\n\n script_cve_id(\"CVE-2016-7445\", \"CVE-2016-8332\", \"CVE-2016-9112\", \"CVE-2016-9113\", \"CVE-2016-9114\", \"CVE-2016-9115\", \"CVE-2016-9116\", \"CVE-2016-9117\", \"CVE-2016-9118\", \"CVE-2016-9572\", \"CVE-2016-9573\", \"CVE-2016-9580\", \"CVE-2016-9581\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : openjpeg2 (SUSE-SU-2016:3270-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openjpeg2 fixes the following issues :\n\n - CVE-2016-9114: NULL pointer Access in function\n imagetopnm of convert.c:1943(jp2) could lead to crash\n [bsc#1007740]\n\n - CVE-2016-9115: Heap Buffer Overflow in function\n imagetotga of convert.c(jp2) [bsc#1007741]\n\n - CVE-2016-9580, CVE-2016-9581: Possible Heap buffer\n overflow via integer overflow and infite loop\n [bsc#1014975]\n\n - CVE-2016-9117: NULL pointer Access in function\n imagetopnm of convert.c(jp2):1289 [bsc#1007743]\n\n - CVE-2016-9118: Heap Buffer Overflow in function\n pnmtoimage of convert.c [bsc#1007744]\n\n - CVE-2016-9112: FPE(Floating Point Exception) in\n lib/openjp2/pi.c:523 [bsc#1007747]\n\n - CVE-2016-9116: NULL pointer Access in function\n imagetopnm of convert.c:2226(jp2) [bsc#1007742]\n\n - CVE-2016-9113: NULL point dereference in function\n imagetobmp of convertbmp.c could lead to crash\n [bsc#1007739]\n\n - CVE-2016-9572 CVE-2016-9573: Insuficient check in\n imagetopnm() could lead to heap buffer overflow\n [bsc#1014543]\n\n - CVE-2016-8332: Malicious file in OpenJPEG JPEG2000\n format could lead to code execution [bsc#1002414]\n\n - CVE-2016-7445: NULL pointer dereference in convert.c\n could lead to crash [bsc#999817]\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1002414\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1007739\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1007740\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1007741\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1007742\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1007743\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1007744\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1007747\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1014543\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1014975\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=999817\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-7445/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8332/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9112/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9113/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9114/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9115/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9116/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9117/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9118/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9572/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9573/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9580/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-9581/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20163270-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?be37f534\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server for Raspberry Pi 12-SP2:zypper in -t\npatch SUSE-SLE-RPI-12-SP2-2016-1914=1\n\nSUSE Linux Enterprise Server 12-SP2:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-2016-1914=1\n\nSUSE Linux Enterprise Desktop 12-SP2:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP2-2016-1914=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenjp2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenjp2-7-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openjpeg2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openjpeg2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/12/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/12/27\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = eregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"x86_64\") audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! ereg(pattern:\"^(2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP2\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! ereg(pattern:\"^(2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP2\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"libopenjp2-7-2.1.0-3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"libopenjp2-7-debuginfo-2.1.0-3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"openjpeg2-debuginfo-2.1.0-3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"openjpeg2-debugsource-2.1.0-3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libopenjp2-7-2.1.0-3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libopenjp2-7-debuginfo-2.1.0-3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"openjpeg2-debuginfo-2.1.0-3.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"openjpeg2-debugsource-2.1.0-3.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"openjpeg2\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:29:08", "bulletinFamily": "scanner", "description": "This update for openjpeg2 fixes the following issues :\n\n - CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could lead to heap buffer overflow [bsc#1014543]\n\n - CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer overflow and infite loop [bsc#1014975]\n\n - CVE-2016-7445: NULL pointer dereference in convert.c could lead to crash [bsc#999817]\n\n - CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to code execution [bsc#1002414]\n\n - CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523 [bsc#1007747]\n\n - CVE-2016-9113: NULL point dereference in function imagetobmp of convertbmp.c could lead to crash [bsc#1007739]\n\n - CVE-2016-9114: NULL pointer Access in function imagetopnm of convert.c:1943(jp2) could lead to crash [bsc#1007740]\n\n - CVE-2016-9115: Heap Buffer Overflow in function imagetotga of convert.c(jp2) [bsc#1007741]\n\n - CVE-2016-9116: NULL pointer Access in function imagetopnm of convert.c:2226(jp2) [bsc#1007742]\n\n - CVE-2016-9117: NULL pointer Access in function imagetopnm of convert.c(jp2):1289 [bsc#1007743]\n\n - CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c [bsc#1007744]", "modified": "2018-10-03T00:00:00", "id": "OPENSUSE-2017-120.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=96646", "published": "2017-01-20T00:00:00", "title": "openSUSE Security Update : openjpeg2 (openSUSE-2017-120)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-120.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(96646);\n script_version(\"3.2\");\n script_cvs_date(\"Date: 2018/10/03 9:51:35\");\n\n script_cve_id(\"CVE-2016-7445\", \"CVE-2016-8332\", \"CVE-2016-9112\", \"CVE-2016-9113\", \"CVE-2016-9114\", \"CVE-2016-9115\", \"CVE-2016-9116\", \"CVE-2016-9117\", \"CVE-2016-9118\", \"CVE-2016-9572\", \"CVE-2016-9573\", \"CVE-2016-9580\", \"CVE-2016-9581\");\n\n script_name(english:\"openSUSE Security Update : openjpeg2 (openSUSE-2017-120)\");\n script_summary(english:\"Check for the openSUSE-2017-120 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openjpeg2 fixes the following issues :\n\n - CVE-2016-9572 CVE-2016-9573: Insuficient check in\n imagetopnm() could lead to heap buffer overflow\n [bsc#1014543]\n\n - CVE-2016-9580, CVE-2016-9581: Possible Heap buffer\n overflow via integer overflow and infite loop\n [bsc#1014975]\n\n - CVE-2016-7445: NULL pointer dereference in convert.c\n could lead to crash [bsc#999817]\n\n - CVE-2016-8332: Malicious file in OpenJPEG JPEG2000\n format could lead to code execution [bsc#1002414]\n\n - CVE-2016-9112: FPE(Floating Point Exception) in\n lib/openjp2/pi.c:523 [bsc#1007747]\n\n - CVE-2016-9113: NULL point dereference in function\n imagetobmp of convertbmp.c could lead to crash\n [bsc#1007739]\n\n - CVE-2016-9114: NULL pointer Access in function\n imagetopnm of convert.c:1943(jp2) could lead to crash\n [bsc#1007740]\n\n - CVE-2016-9115: Heap Buffer Overflow in function\n imagetotga of convert.c(jp2) [bsc#1007741]\n\n - CVE-2016-9116: NULL pointer Access in function\n imagetopnm of convert.c:2226(jp2) [bsc#1007742]\n\n - CVE-2016-9117: NULL pointer Access in function\n imagetopnm of convert.c(jp2):1289 [bsc#1007743]\n\n - CVE-2016-9118: Heap Buffer Overflow in function\n pnmtoimage of convert.c [bsc#1007744]\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1002414\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007739\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007740\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007741\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007742\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007743\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007744\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007747\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1014543\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1014975\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=999817\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected openjpeg2 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenjp2-7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenjp2-7-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenjp2-7-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenjp2-7-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/01/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/01/20\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"libopenjp2-7-2.1.0-9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"libopenjp2-7-debuginfo-2.1.0-9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"openjpeg2-2.1.0-9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"openjpeg2-debuginfo-2.1.0-9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"openjpeg2-debugsource-2.1.0-9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"openjpeg2-devel-2.1.0-9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"libopenjp2-7-32bit-2.1.0-9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"libopenjp2-7-debuginfo-32bit-2.1.0-9.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libopenjp2-7 / libopenjp2-7-32bit / libopenjp2-7-debuginfo / etc\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:29:05", "bulletinFamily": "scanner", "description": "This update for openjpeg2 fixes the following issues :\n\n - CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could lead to heap buffer overflow [bsc#1014543]\n\n - CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer overflow and infite loop [bsc#1014975]\n\n - CVE-2016-7445: NULL pointer dereference in convert.c could lead to crash [bsc#999817]\n\n - CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to code execution [bsc#1002414]\n\n - CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523 [bsc#1007747]\n\n - CVE-2016-9113: NULL point dereference in function imagetobmp of convertbmp.c could lead to crash [bsc#1007739]\n\n - CVE-2016-9114: NULL pointer Access in function imagetopnm of convert.c:1943(jp2) could lead to crash [bsc#1007740]\n\n - CVE-2016-9115: Heap Buffer Overflow in function imagetotga of convert.c(jp2) [bsc#1007741]\n\n - CVE-2016-9116: NULL pointer Access in function imagetopnm of convert.c:2226(jp2) [bsc#1007742]\n\n - CVE-2016-9117: NULL pointer Access in function imagetopnm of convert.c(jp2):1289 [bsc#1007743]\n\n - CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c [bsc#1007744]", "modified": "2018-10-03T00:00:00", "id": "OPENSUSE-2017-108.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=96580", "published": "2017-01-18T00:00:00", "title": "openSUSE Security Update : openjpeg2 (openSUSE-2017-108)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-108.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(96580);\n script_version(\"3.2\");\n script_cvs_date(\"Date: 2018/10/03 9:51:35\");\n\n script_cve_id(\"CVE-2016-7445\", \"CVE-2016-8332\", \"CVE-2016-9112\", \"CVE-2016-9113\", \"CVE-2016-9114\", \"CVE-2016-9115\", \"CVE-2016-9116\", \"CVE-2016-9117\", \"CVE-2016-9118\", \"CVE-2016-9572\", \"CVE-2016-9573\", \"CVE-2016-9580\", \"CVE-2016-9581\");\n\n script_name(english:\"openSUSE Security Update : openjpeg2 (openSUSE-2017-108)\");\n script_summary(english:\"Check for the openSUSE-2017-108 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openjpeg2 fixes the following issues :\n\n - CVE-2016-9572 CVE-2016-9573: Insuficient check in\n imagetopnm() could lead to heap buffer overflow\n [bsc#1014543]\n\n - CVE-2016-9580, CVE-2016-9581: Possible Heap buffer\n overflow via integer overflow and infite loop\n [bsc#1014975]\n\n - CVE-2016-7445: NULL pointer dereference in convert.c\n could lead to crash [bsc#999817]\n\n - CVE-2016-8332: Malicious file in OpenJPEG JPEG2000\n format could lead to code execution [bsc#1002414]\n\n - CVE-2016-9112: FPE(Floating Point Exception) in\n lib/openjp2/pi.c:523 [bsc#1007747]\n\n - CVE-2016-9113: NULL point dereference in function\n imagetobmp of convertbmp.c could lead to crash\n [bsc#1007739]\n\n - CVE-2016-9114: NULL pointer Access in function\n imagetopnm of convert.c:1943(jp2) could lead to crash\n [bsc#1007740]\n\n - CVE-2016-9115: Heap Buffer Overflow in function\n imagetotga of convert.c(jp2) [bsc#1007741]\n\n - CVE-2016-9116: NULL pointer Access in function\n imagetopnm of convert.c:2226(jp2) [bsc#1007742]\n\n - CVE-2016-9117: NULL pointer Access in function\n imagetopnm of convert.c(jp2):1289 [bsc#1007743]\n\n - CVE-2016-9118: Heap Buffer Overflow in function\n pnmtoimage of convert.c [bsc#1007744]\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1002414\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007739\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007740\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007741\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007742\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007743\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007744\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007747\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1014543\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1014975\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=999817\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected openjpeg2 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenjp2-7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenjp2-7-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/01/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/01/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libopenjp2-7-2.1.0-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libopenjp2-7-debuginfo-2.1.0-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"openjpeg2-2.1.0-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"openjpeg2-debuginfo-2.1.0-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"openjpeg2-debugsource-2.1.0-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"openjpeg2-devel-2.1.0-2.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libopenjp2-7 / libopenjp2-7-debuginfo / openjpeg2 / etc\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:29:05", "bulletinFamily": "scanner", "description": "This update for openjpeg2 fixes the following issues :\n\n - CVE-2016-9114: NULL pointer Access in function imagetopnm of convert.c:1943(jp2) could lead to crash [bsc#1007740]\n\n - CVE-2016-9115: Heap Buffer Overflow in function imagetotga of convert.c(jp2) [bsc#1007741]\n\n - CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer overflow and infite loop [bsc#1014975]\n\n - CVE-2016-9117: NULL pointer Access in function imagetopnm of convert.c(jp2):1289 [bsc#1007743]\n\n - CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c [bsc#1007744] \n\n - CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523 [bsc#1007747] \n\n - CVE-2016-9116: NULL pointer Access in function imagetopnm of convert.c:2226(jp2) [bsc#1007742]\n\n - CVE-2016-9113: NULL point dereference in function imagetobmp of convertbmp.c could lead to crash [bsc#1007739] \n\n - CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could lead to heap buffer overflow [bsc#1014543]\n\n - CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to code execution [bsc#1002414] \n\n - CVE-2016-7445: NULL pointer dereference in convert.c could lead to crash [bsc#999817] \n\nThis update was imported from the SUSE:SLE-12-SP2:Update update project.", "modified": "2018-10-03T00:00:00", "id": "OPENSUSE-2017-101.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=96577", "published": "2017-01-18T00:00:00", "title": "openSUSE Security Update : openjpeg2 (openSUSE-2017-101)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-101.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(96577);\n script_version(\"3.2\");\n script_cvs_date(\"Date: 2018/10/03 9:51:35\");\n\n script_cve_id(\"CVE-2016-7445\", \"CVE-2016-8332\", \"CVE-2016-9112\", \"CVE-2016-9113\", \"CVE-2016-9114\", \"CVE-2016-9115\", \"CVE-2016-9116\", \"CVE-2016-9117\", \"CVE-2016-9118\", \"CVE-2016-9572\", \"CVE-2016-9573\", \"CVE-2016-9580\", \"CVE-2016-9581\");\n\n script_name(english:\"openSUSE Security Update : openjpeg2 (openSUSE-2017-101)\");\n script_summary(english:\"Check for the openSUSE-2017-101 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openjpeg2 fixes the following issues :\n\n - CVE-2016-9114: NULL pointer Access in function\n imagetopnm of convert.c:1943(jp2) could lead to crash\n [bsc#1007740]\n\n - CVE-2016-9115: Heap Buffer Overflow in function\n imagetotga of convert.c(jp2) [bsc#1007741]\n\n - CVE-2016-9580, CVE-2016-9581: Possible Heap buffer\n overflow via integer overflow and infite loop\n [bsc#1014975]\n\n - CVE-2016-9117: NULL pointer Access in function\n imagetopnm of convert.c(jp2):1289 [bsc#1007743]\n\n - CVE-2016-9118: Heap Buffer Overflow in function\n pnmtoimage of convert.c [bsc#1007744] \n\n - CVE-2016-9112: FPE(Floating Point Exception) in\n lib/openjp2/pi.c:523 [bsc#1007747] \n\n - CVE-2016-9116: NULL pointer Access in function\n imagetopnm of convert.c:2226(jp2) [bsc#1007742]\n\n - CVE-2016-9113: NULL point dereference in function\n imagetobmp of convertbmp.c could lead to crash\n [bsc#1007739] \n\n - CVE-2016-9572 CVE-2016-9573: Insuficient check in\n imagetopnm() could lead to heap buffer overflow\n [bsc#1014543]\n\n - CVE-2016-8332: Malicious file in OpenJPEG JPEG2000\n format could lead to code execution [bsc#1002414] \n\n - CVE-2016-7445: NULL pointer dereference in convert.c\n could lead to crash [bsc#999817] \n\nThis update was imported from the SUSE:SLE-12-SP2:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1002414\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007739\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007740\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007741\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007742\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007743\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007744\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007747\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1014543\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1014975\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=999817\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected openjpeg2 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenjp2-7\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenjp2-7-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenjp2-7-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenjp2-7-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:openjpeg2-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/01/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/01/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libopenjp2-7-2.1.0-11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libopenjp2-7-debuginfo-2.1.0-11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"openjpeg2-2.1.0-11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"openjpeg2-debuginfo-2.1.0-11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"openjpeg2-debugsource-2.1.0-11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"openjpeg2-devel-2.1.0-11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", cpu:\"x86_64\", reference:\"libopenjp2-7-32bit-2.1.0-11.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", cpu:\"x86_64\", reference:\"libopenjp2-7-debuginfo-32bit-2.1.0-11.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libopenjp2-7 / libopenjp2-7-32bit / libopenjp2-7-debuginfo / etc\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2019-05-29T18:34:35", "bulletinFamily": "scanner", "description": "Multiple vulnerabilities in OpenJPEG,\na JPEG 2000 image compression / decompression library, may result in denial of\nservice or the execution of arbitrary code if a malformed JPEG 2000 file is\nprocessed.", "modified": "2019-03-18T00:00:00", "published": "2017-01-20T00:00:00", "id": "OPENVAS:1361412562310703768", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310703768", "title": "Debian Security Advisory DSA 3768-1 (openjpeg2 - security update)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3768.nasl 14275 2019-03-18 14:39:45Z cfischer $\n# Auto-generated from advisory DSA 3768-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.703768\");\n script_version(\"$Revision: 14275 $\");\n script_cve_id(\"CVE-2016-5159\", \"CVE-2016-8332\", \"CVE-2016-9572\", \"CVE-2016-9573\");\n script_name(\"Debian Security Advisory DSA 3768-1 (openjpeg2 - security update)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-18 15:39:45 +0100 (Mon, 18 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-01-20 00:00:00 +0100 (Fri, 20 Jan 2017)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"http://www.debian.org/security/2017/dsa-3768.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB8\");\n script_tag(name:\"affected\", value:\"openjpeg2 on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (jessie),\nthese problems have been fixed in version 2.1.0-2+deb8u2.\n\nFor the unstable distribution (sid), these problems will be fixed soon.\n\nWe recommend that you upgrade your openjpeg2 packages.\");\n script_tag(name:\"summary\", value:\"Multiple vulnerabilities in OpenJPEG,\na JPEG 2000 image compression / decompression library, may result in denial of\nservice or the execution of arbitrary code if a malformed JPEG 2000 file is\nprocessed.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software\nversion using the apt package manager.\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif((res = isdpkgvuln(pkg:\"libopenjp2-7:amd64\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libopenjp2-7:i386\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\n\nif((res = isdpkgvuln(pkg:\"libopenjp2-7-dbg:amd64\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libopenjp2-7-dbg:i386\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\n\nif((res = isdpkgvuln(pkg:\"libopenjp2-7-dev\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libopenjp2-tools\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libopenjp3d-tools\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libopenjp3d7:amd64\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libopenjp3d7:i386\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\n\nif((res = isdpkgvuln(pkg:\"libopenjpip-dec-server\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libopenjpip-server\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libopenjpip-viewer\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libopenjpip7:amd64\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\nif((res = isdpkgvuln(pkg:\"libopenjpip7:i386\", ver:\"2.1.0-2+deb8u2\", rls:\"DEB8\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2017-07-24T12:57:44", "bulletinFamily": "scanner", "description": "Multiple vulnerabilities in OpenJPEG,\na JPEG 2000 image compression / decompression library, may result in denial of\nservice or the execution of arbitrary code if a malformed JPEG 2000 file is\nprocessed.", "modified": "2017-07-07T00:00:00", "published": "2017-01-20T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=703768", "id": "OPENVAS:703768", "title": "Debian Security Advisory DSA 3768-1 (openjpeg2 - security update)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3768.nasl 6607 2017-07-07 12:04:25Z cfischer $\n# Auto-generated from advisory DSA 3768-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703768);\n script_version(\"$Revision: 6607 $\");\n script_cve_id(\"CVE-2016-5159\", \"CVE-2016-8332\", \"CVE-2016-9572\", \"CVE-2016-9573\");\n script_name(\"Debian Security Advisory DSA 3768-1 (openjpeg2 - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-07-07 14:04:25 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name: \"creation_date\", value: \"2017-01-20 00:00:00 +0100 (Fri, 20 Jan 2017)\");\n script_tag(name: \"cvss_base\", value: \"10.0\");\n script_tag(name: \"cvss_base_vector\", value: \"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2017/dsa-3768.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"openjpeg2 on Debian Linux\");\n script_tag(name: \"solution\", value: \"For the stable distribution (jessie),\nthese problems have been fixed in version 2.1.0-2+deb8u2.\n\nFor the unstable distribution (sid), these problems will be fixed soon.\n\nWe recommend that you upgrade your openjpeg2 packages.\");\n script_tag(name: \"summary\", value: \"Multiple vulnerabilities in OpenJPEG,\na JPEG 2000 image compression / decompression library, may result in denial of\nservice or the execution of arbitrary code if a malformed JPEG 2000 file is\nprocessed.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed software\nversion using the apt package manager.\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libopenjp2-7:amd64\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libopenjp2-7:i386\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\n\nif ((res = isdpkgvuln(pkg:\"libopenjp2-7-dbg:amd64\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libopenjp2-7-dbg:i386\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\n\nif ((res = isdpkgvuln(pkg:\"libopenjp2-7-dev\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libopenjp2-tools\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libopenjp3d-tools\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libopenjp3d7:amd64\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libopenjp3d7:i386\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\n\nif ((res = isdpkgvuln(pkg:\"libopenjpip-dec-server\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libopenjpip-server\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libopenjpip-viewer\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libopenjpip7:amd64\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libopenjpip7:i386\", ver:\"2.1.0-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:34:41", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2018-11-16T00:00:00", "published": "2017-01-20T00:00:00", "id": "OPENVAS:1361412562310851480", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851480", "title": "SuSE Update for openjpeg2 openSUSE-SU-2017:0207-1 (openjpeg2)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2017_0207_1.nasl 12381 2018-11-16 11:16:30Z cfischer $\n#\n# SuSE Update for openjpeg2 openSUSE-SU-2017:0207-1 (openjpeg2)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851480\");\n script_version(\"$Revision: 12381 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-16 12:16:30 +0100 (Fri, 16 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2017-01-20 05:40:23 +0100 (Fri, 20 Jan 2017)\");\n script_cve_id(\"CVE-2016-7445\", \"CVE-2016-8332\", \"CVE-2016-9112\", \"CVE-2016-9113\",\n \"CVE-2016-9114\", \"CVE-2016-9115\", \"CVE-2016-9116\", \"CVE-2016-9117\",\n \"CVE-2016-9118\", \"CVE-2016-9572\", \"CVE-2016-9573\", \"CVE-2016-9580\",\n \"CVE-2016-9581\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SuSE Update for openjpeg2 openSUSE-SU-2017:0207-1 (openjpeg2)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'openjpeg2'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"This update for openjpeg2 fixes the following issues:\n\n * CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could\n lead to heap buffer overflow [bsc#1014543]\n\n * CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer\n overflow and infite loop [bsc#1014975]\n\n * CVE-2016-7445: Null pointer dereference in convert.c could lead to crash\n [bsc#999817]\n\n * CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to\n code execution [bsc#1002414]\n\n * CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523\n [bsc#1007747]\n\n * CVE-2016-9113: NULL point dereference in function imagetobmp of\n convertbmp.c could lead to crash [bsc#1007739]\n\n * CVE-2016-9114: NULL Pointer Access in function imagetopnm of\n convert.c:1943(jp2) could lead to crash [bsc#1007740]\n\n * CVE-2016-9115: Heap Buffer Overflow in function imagetotga of\n convert.c(jp2) [bsc#1007741]\n\n * CVE-2016-9116: NULL Pointer Access in function imagetopnm of\n convert.c:2226(jp2) [bsc#1007742]\n\n * CVE-2016-9117: NULL Pointer Access in function imagetopnm of\n convert.c(jp2):1289 [bsc#1007743]\n\n * CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c\n [bsc#1007744]\");\n script_tag(name:\"affected\", value:\"openjpeg2 on openSUSE Leap 42.1\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2017:0207_1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.1\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\nres = \"\";\n\nif(release == \"openSUSELeap42.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"libopenjp2-7\", rpm:\"libopenjp2-7~2.1.0~9.1\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libopenjp2-7-debuginfo\", rpm:\"libopenjp2-7-debuginfo~2.1.0~9.1\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2\", rpm:\"openjpeg2~2.1.0~9.1\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2-debuginfo\", rpm:\"openjpeg2-debuginfo~2.1.0~9.1\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2-debugsource\", rpm:\"openjpeg2-debugsource~2.1.0~9.1\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2-devel\", rpm:\"openjpeg2-devel~2.1.0~9.1\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libopenjp2-7-32bit\", rpm:\"libopenjp2-7-32bit~2.1.0~9.1\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libopenjp2-7-debuginfo-32bit\", rpm:\"libopenjp2-7-debuginfo-32bit~2.1.0~9.1\", rls:\"openSUSELeap42.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:34:42", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2018-11-16T00:00:00", "published": "2017-02-22T00:00:00", "id": "OPENVAS:1361412562310851510", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851510", "title": "SuSE Update for openjpeg2 openSUSE-SU-2017:0155-1 (openjpeg2)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2017_0155_1.nasl 12381 2018-11-16 11:16:30Z cfischer $\n#\n# SuSE Update for openjpeg2 openSUSE-SU-2017:0155-1 (openjpeg2)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851510\");\n script_version(\"$Revision: 12381 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-16 12:16:30 +0100 (Fri, 16 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2017-02-22 15:17:36 +0100 (Wed, 22 Feb 2017)\");\n script_cve_id(\"CVE-2016-7445\", \"CVE-2016-8332\", \"CVE-2016-9112\", \"CVE-2016-9113\", \"CVE-2016-9114\", \"CVE-2016-9115\", \"CVE-2016-9116\", \"CVE-2016-9117\", \"CVE-2016-9118\", \"CVE-2016-9572\", \"CVE-2016-9573\", \"CVE-2016-9580\", \"CVE-2016-9581\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SuSE Update for openjpeg2 openSUSE-SU-2017:0155-1 (openjpeg2)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'openjpeg2'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"This update for openjpeg2 fixes the following issues:\n\n * CVE-2016-9114: NULL Pointer Access in function imagetopnm of\n convert.c:1943(jp2) could lead to crash [bsc#1007740]\n\n * CVE-2016-9115: Heap Buffer Overflow in function imagetotga of\n convert.c(jp2) [bsc#1007741]\n\n * CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer\n overflow and infite loop [bsc#1014975]\n\n * CVE-2016-9117: NULL Pointer Access in function imagetopnm of\n convert.c(jp2):1289 [bsc#1007743]\n\n * CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c\n [bsc#1007744]\n\n * CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523\n [bsc#1007747]\n\n * CVE-2016-9116: NULL Pointer Access in function imagetopnm of\n convert.c:2226(jp2) [bsc#1007742]\n\n * CVE-2016-9113: NULL point dereference in function imagetobmp of\n convertbmp.c could lead to crash [bsc#1007739]\n\n * CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could\n lead to heap buffer overflow [bsc#1014543]\n\n * CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to\n code execution [bsc#1002414]\n\n * CVE-2016-7445: Null pointer dereference in convert.c could lead to crash\n [bsc#999817]\n\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\");\n script_tag(name:\"affected\", value:\"openjpeg2 on openSUSE Leap 42.2\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2017:0155_1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.2\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\nres = \"\";\n\nif(release == \"openSUSELeap42.2\")\n{\n\n if ((res = isrpmvuln(pkg:\"libopenjp2-7\", rpm:\"libopenjp2-7~2.1.0~11.1\", rls:\"openSUSELeap42.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libopenjp2-7-debuginfo\", rpm:\"libopenjp2-7-debuginfo~2.1.0~11.1\", rls:\"openSUSELeap42.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2\", rpm:\"openjpeg2~2.1.0~11.1\", rls:\"openSUSELeap42.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2-debuginfo\", rpm:\"openjpeg2-debuginfo~2.1.0~11.1\", rls:\"openSUSELeap42.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2-debugsource\", rpm:\"openjpeg2-debugsource~2.1.0~11.1\", rls:\"openSUSELeap42.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2-devel\", rpm:\"openjpeg2-devel~2.1.0~11.1\", rls:\"openSUSELeap42.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libopenjp2-7-32bit\", rpm:\"libopenjp2-7-32bit~2.1.0~11.1\", rls:\"openSUSELeap42.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libopenjp2-7-debuginfo-32bit\", rpm:\"libopenjp2-7-debuginfo-32bit~2.1.0~11.1\", rls:\"openSUSELeap42.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:34:41", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2018-11-16T00:00:00", "published": "2017-01-18T00:00:00", "id": "OPENVAS:1361412562310851478", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851478", "title": "SuSE Update for openjpeg2 openSUSE-SU-2017:0185-1 (openjpeg2)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_suse_2017_0185_1.nasl 12381 2018-11-16 11:16:30Z cfischer $\n#\n# SuSE Update for openjpeg2 openSUSE-SU-2017:0185-1 (openjpeg2)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851478\");\n script_version(\"$Revision: 12381 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-16 12:16:30 +0100 (Fri, 16 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2017-01-18 05:46:30 +0100 (Wed, 18 Jan 2017)\");\n script_cve_id(\"CVE-2016-7445\", \"CVE-2016-8332\", \"CVE-2016-9112\", \"CVE-2016-9113\",\n \"CVE-2016-9114\", \"CVE-2016-9115\", \"CVE-2016-9116\", \"CVE-2016-9117\",\n \"CVE-2016-9118\", \"CVE-2016-9572\", \"CVE-2016-9573\", \"CVE-2016-9580\",\n \"CVE-2016-9581\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"SuSE Update for openjpeg2 openSUSE-SU-2017:0185-1 (openjpeg2)\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'openjpeg2'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"This update for openjpeg2 fixes the following issues:\n\n * CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could\n lead to heap buffer overflow [bsc#1014543]\n\n * CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer\n overflow and infite loop [bsc#1014975]\n\n * CVE-2016-7445: Null pointer dereference in convert.c could lead to crash\n [bsc#999817]\n\n * CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to\n code execution [bsc#1002414]\n\n * CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523\n [bsc#1007747]\n\n * CVE-2016-9113: NULL point dereference in function imagetobmp of\n convertbmp.c could lead to crash [bsc#1007739]\n\n * CVE-2016-9114: NULL Pointer Access in function imagetopnm of\n convert.c:1943(jp2) could lead to crash [bsc#1007740]\n\n * CVE-2016-9115: Heap Buffer Overflow in function imagetotga of\n convert.c(jp2) [bsc#1007741]\n\n * CVE-2016-9116: NULL Pointer Access in function imagetopnm of\n convert.c:2226(jp2) [bsc#1007742]\n\n * CVE-2016-9117: NULL Pointer Access in function imagetopnm of\n convert.c(jp2):1289 [bsc#1007743]\n\n * CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c\n [bsc#1007744]\");\n script_tag(name:\"affected\", value:\"openjpeg2 on openSUSE 13.2\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2017:0185_1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSE13\\.2\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\nres = \"\";\n\nif(release == \"openSUSE13.2\")\n{\n\n if ((res = isrpmvuln(pkg:\"libopenjp2-7\", rpm:\"libopenjp2-7~2.1.0~2.3.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"libopenjp2-7-debuginfo\", rpm:\"libopenjp2-7-debuginfo~2.1.0~2.3.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2\", rpm:\"openjpeg2~2.1.0~2.3.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2-debuginfo\", rpm:\"openjpeg2-debuginfo~2.1.0~2.3.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2-debugsource\", rpm:\"openjpeg2-debugsource~2.1.0~2.3.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"openjpeg2-devel\", rpm:\"openjpeg2-devel~2.1.0~2.3.1\", rls:\"openSUSE13.2\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "debian": [{"lastseen": "2019-05-30T02:21:23", "bulletinFamily": "unix", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3768-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nJanuary 20, 2017 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : openjpeg2\nCVE ID : CVE-2016-5159 CVE-2016-8332 CVE-2016-9572 CVE-2016-9573\n\nMultiple vulnerabilities in OpenJPEG, a JPEG 2000 image compression /\ndecompression library, may result in denial of service or the execution\nof arbitrary code if a malformed JPEG 2000 file is processed.\n\t\t \nFor the stable distribution (jessie), these problems have been fixed in\nversion 2.1.0-2+deb8u2.\n\nFor the unstable distribution (sid), these problems will be fixed soon.\n\nWe recommend that you upgrade your openjpeg2 packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "modified": "2017-01-20T22:08:17", "published": "2017-01-20T22:08:17", "id": "DEBIAN:DSA-3678-1:F57E2", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2017/msg00019.html", "title": "[SECURITY] [DSA 3678-1] openjpeg2 security update", "type": "debian", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "suse": [{"lastseen": "2016-12-27T18:05:30", "bulletinFamily": "unix", "description": "This update for openjpeg2 fixes the following issues:\n\n * CVE-2016-9114: NULL Pointer Access in function imagetopnm of\n convert.c:1943(jp2) could lead to crash [bsc#1007740]\n * CVE-2016-9115: Heap Buffer Overflow in function imagetotga of\n convert.c(jp2) [bsc#1007741]\n * CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer\n overflow and infite loop [bsc#1014975]\n * CVE-2016-9117: NULL Pointer Access in function imagetopnm of\n convert.c(jp2):1289 [bsc#1007743]\n * CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c\n [bsc#1007744]\n * CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523\n [bsc#1007747]\n * CVE-2016-9116: NULL Pointer Access in function imagetopnm of\n convert.c:2226(jp2) [bsc#1007742]\n * CVE-2016-9113: NULL point dereference in function imagetobmp of\n convertbmp.c could lead to crash [bsc#1007739]\n * CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could\n lead to heap buffer overflow [bsc#1014543]\n * CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to\n code execution [bsc#1002414]\n * CVE-2016-7445: Null pointer dereference in convert.c could lead to crash\n [bsc#999817]\n\n", "modified": "2016-12-27T15:07:08", "published": "2016-12-27T15:07:08", "href": "http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00095.html", "id": "SUSE-SU-2016:3270-1", "title": "Security update for openjpeg2 (important)", "type": "suse", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-01-17T18:59:44", "bulletinFamily": "unix", "description": "This update for openjpeg2 fixes the following issues:\n\n * CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could\n lead to heap buffer overflow [bsc#1014543]\n * CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer\n overflow and infite loop [bsc#1014975]\n * CVE-2016-7445: Null pointer dereference in convert.c could lead to crash\n [bsc#999817]\n * CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to\n code execution [bsc#1002414]\n * CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523\n [bsc#1007747]\n * CVE-2016-9113: NULL point dereference in function imagetobmp of\n convertbmp.c could lead to crash [bsc#1007739]\n * CVE-2016-9114: NULL Pointer Access in function imagetopnm of\n convert.c:1943(jp2) could lead to crash [bsc#1007740]\n * CVE-2016-9115: Heap Buffer Overflow in function imagetotga of\n convert.c(jp2) [bsc#1007741]\n * CVE-2016-9116: NULL Pointer Access in function imagetopnm of\n convert.c:2226(jp2) [bsc#1007742]\n * CVE-2016-9117: NULL Pointer Access in function imagetopnm of\n convert.c(jp2):1289 [bsc#1007743]\n * CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c\n [bsc#1007744]\n\n", "modified": "2017-01-17T19:47:35", "published": "2017-01-17T19:47:35", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00030.html", "id": "OPENSUSE-SU-2017:0185-1", "title": "Security update for openjpeg2 (important)", "type": "suse", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-01-16T19:01:21", "bulletinFamily": "unix", "description": "This update for openjpeg2 fixes the following issues:\n\n * CVE-2016-9114: NULL Pointer Access in function imagetopnm of\n convert.c:1943(jp2) could lead to crash [bsc#1007740]\n * CVE-2016-9115: Heap Buffer Overflow in function imagetotga of\n convert.c(jp2) [bsc#1007741]\n * CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer\n overflow and infite loop [bsc#1014975]\n * CVE-2016-9117: NULL Pointer Access in function imagetopnm of\n convert.c(jp2):1289 [bsc#1007743]\n * CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c\n [bsc#1007744]\n * CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523\n [bsc#1007747]\n * CVE-2016-9116: NULL Pointer Access in function imagetopnm of\n convert.c:2226(jp2) [bsc#1007742]\n * CVE-2016-9113: NULL point dereference in function imagetobmp of\n convertbmp.c could lead to crash [bsc#1007739]\n * CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could\n lead to heap buffer overflow [bsc#1014543]\n * CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to\n code execution [bsc#1002414]\n * CVE-2016-7445: Null pointer dereference in convert.c could lead to crash\n [bsc#999817]\n\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\n\n", "modified": "2017-01-16T19:20:39", "published": "2017-01-16T19:20:39", "id": "OPENSUSE-SU-2017:0155-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00021.html", "title": "Security update for openjpeg2 (important)", "type": "suse", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-01-19T14:59:37", "bulletinFamily": "unix", "description": "This update for openjpeg2 fixes the following issues:\n\n * CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could\n lead to heap buffer overflow [bsc#1014543]\n * CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer\n overflow and infite loop [bsc#1014975]\n * CVE-2016-7445: Null pointer dereference in convert.c could lead to crash\n [bsc#999817]\n * CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to\n code execution [bsc#1002414]\n * CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523\n [bsc#1007747]\n * CVE-2016-9113: NULL point dereference in function imagetobmp of\n convertbmp.c could lead to crash [bsc#1007739]\n * CVE-2016-9114: NULL Pointer Access in function imagetopnm of\n convert.c:1943(jp2) could lead to crash [bsc#1007740]\n * CVE-2016-9115: Heap Buffer Overflow in function imagetotga of\n convert.c(jp2) [bsc#1007741]\n * CVE-2016-9116: NULL Pointer Access in function imagetopnm of\n convert.c:2226(jp2) [bsc#1007742]\n * CVE-2016-9117: NULL Pointer Access in function imagetopnm of\n convert.c(jp2):1289 [bsc#1007743]\n * CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c\n [bsc#1007744]\n\n", "modified": "2017-01-19T15:08:59", "published": "2017-01-19T15:08:59", "id": "OPENSUSE-SU-2017:0207-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00034.html", "title": "Security update for openjpeg2 (important)", "type": "suse", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-09-26T05:37:45", "bulletinFamily": "unix", "description": "This update for openjpeg2 fixes the following issues:\n\n * CVE-2016-9114: NULL Pointer Access in function imagetopnm of\n convert.c:1943(jp2) could lead to crash [bsc#1007740]\n * CVE-2016-9115: Heap Buffer Overflow in function imagetotga of\n convert.c(jp2) [bsc#1007741]\n * CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer\n overflow and infite loop [bsc#1014975]\n * CVE-2016-9117: NULL Pointer Access in function imagetopnm of\n convert.c(jp2):1289 [bsc#1007743]\n * CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c\n [bsc#1007744]\n * CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523\n [bsc#1007747]\n * CVE-2016-9116: NULL Pointer Access in function imagetopnm of\n convert.c:2226(jp2) [bsc#1007742]\n * CVE-2016-9113: NULL point dereference in function imagetobmp of\n convertbmp.c could lead to crash [bsc#1007739]\n * CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could\n lead to heap buffer overflow [bsc#1014543]\n * CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format could lead to\n code execution [bsc#1002414]\n * CVE-2016-7445: Null pointer dereference in convert.c could lead to crash\n [bsc#999817]\n * CVE 2016-7163: Integer Overflow could lead to remote code execution\n [bsc#997857]\n * CVE 2015-8871: Use-after-free in opj_j2k_write_mco function could lead\n to denial of service [bsc#979907]\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\n\n", "modified": "2017-09-26T03:07:23", "published": "2017-09-26T03:07:23", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-09/msg00082.html", "id": "OPENSUSE-SU-2017:2567-1", "title": "Security update for openjpeg2 (important)", "type": "suse", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}