Lucene search

K
mageiaGentoo FoundationMGASA-2016-0362
HistoryNov 03, 2016 - 12:02 p.m.

Updated openjpeg2 packages fix security vulnerabilities

2016-11-0312:02:50
Gentoo Foundation
advisories.mageia.org
7

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.032 Low

EPSS

Percentile

91.0%

A specially crafted JPEG2000 image file can force Out-Of-Bounds Read in opj_tcd_free_tile() (CVE-2016-3181). A specially crafted JPEG2000 image file can force Heap Corruption in opj_free() (CVE-2016-3182). A specially crafted JPEG2000 image file can force Out-Of-Bounds Read in sycc422_to_rgb() (CVE-2016-3183). OpenJPEG Heap Buffer Overflow in function color_cmyk_to_rgb() in color.c (CVE-2016-4796). OpenJPEG division-by-zero in function opj_tcd_init_tile() in tcd.c (CVE-2016-4797). Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data (CVE-2016-5157). Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write (CVE-2016-7163). convert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving the variable s (CVE-2016-7445). A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. An exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution (CVE-2016-8332).

OSVersionArchitecturePackageVersionFilename
Mageia5noarchopenjpeg2< 2.1.2-1openjpeg2-2.1.2-1.mga5
Mageia5noarchghostscript< 9.14-3.2ghostscript-9.14-3.2.mga5

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.032 Low

EPSS

Percentile

91.0%