Bug 433766 – <media-libs/openjpeg-1.5.1: JPEG2000 Image Processing Buffer Overflow Vulnerability (CVE-2012-3535)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2012-09-03 10:28:55 UTC]

Description
A vulnerability has been reported in OpenJPEG, which can be exploited by malicious people to potentially compromise an application using the library.

The vulnerability is caused due to an error when decoding images and can be exploited to cause a heap-based buffer overflow via a specially crafted file.

Successful exploitation may allow execution of arbitrary code.

The vulnerability is reported in version 1.5.0. Other versions may also be affected.


Solution
No official solution is currently available.

[Comment 1 Agostino Sarubbo 2012-09-03 10:29:37 UTC]

Note: this is not CVE-2012-3358 ( bug 425772 )

[Comment 2 GLSAMaker/CVETool Bot 2012-09-08 15:44:27 UTC]

CVE-2012-3535 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3535):
  Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote
  attackers to cause a denial of service (application crash) and possibly
  execute arbitrary code via a crafted JPEG2000 file.

[Comment 3 Sean Amoss (RETIRED) 2013-09-29 15:22:11 UTC]

GLSA request filed.

[Comment 4 GLSAMaker/CVETool Bot 2013-10-10 11:49:02 UTC]

This issue was resolved and addressed in
 GLSA 201310-07 at http://security.gentoo.org/glsa/glsa-201310-07.xml
by GLSA coordinator Sean Amoss (ackle).