Bug 577608 (CVE-2016-3181, CVE-2016-3182, CVE-2016-3183) – <media-libs/openjpeg-2.1.1_p20160922: multiple vulnerabilities

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Agostino Sarubbo 2016-03-17 11:50:02 UTC]

http://www.openwall.com/lists/oss-security/2016/03/14/12
http://www.openwall.com/lists/oss-security/2016/03/14/13
http://www.openwall.com/lists/oss-security/2016/03/14/14

[Comment 1 Arfrever Frehtes Taifersar Arahesis 2016-08-13 01:52:20 UTC]

https://github.com/uclouvain/openjpeg/blob/v2.1.1/CHANGELOG.md
" ・ Out-Of-Bounds Read in sycc422_to_rgb function #726
  ・ Heap Corruption in opj_free function #725
  ・ Out-Of-Bounds Read in opj_tcd_free_tile function #724"

https://github.com/uclouvain/openjpeg/issues/724
https://github.com/uclouvain/openjpeg/issues/725
https://github.com/uclouvain/openjpeg/issues/726

media-libs/openjpeg-2.1.1 with above fixes was released on 2016-07-05.

[Comment 2 Thomas Deutschmann (RETIRED) 2016-09-26 14:09:56 UTC]

With the permission of the Gentoo Graphics project I pushed =media-libs/openjpeg-2.1.1_p20160922 into the tree: Actually we wanted to wait for an official v2.1.2 release but upstream postponed the release for another week. Because Gentoo is still at v2.1.0 which has some critical vulnerabilities which are allowing drive-by-download attacks we decided to do a snapshot release.

This snaptshot release (based on v2.1.1) from 2016-09-22 does contain all currently published security fixes, up to CVE-2016-7445:

> commit 30e68615830631059a72b52682ab81bb8b3ca153
> Author: Thomas Deutschmann
> Date:   Mon Sep 26 15:56:16 2016 +0200
> 
>     media-libs/openjpeg: Bump to snapshot release based on v2.1.1 from 2016-09-22
> 
>     Ebuild-releated changes:
>     ========================
>      - EAPI bumped to v6
> 
>      - Test suite re-enabled and fixed (bug #409263)
> 
>     Gentoo-Bug: https://bugs.gentoo.org/409263
>     Gentoo-Bug: https://bugs.gentoo.org/577608
>     Gentoo-Bug: https://bugs.gentoo.org/572430
>     Gentoo-Bug: https://bugs.gentoo.org/560632
>     Gentoo-Bug: https://bugs.gentoo.org/594740
> 
>     Package-Manager: portage-2.3.1

[Comment 3 Thomas Deutschmann (RETIRED) 2016-12-07 23:59:40 UTC]

New GLSA created.

[Comment 4 GLSAMaker/CVETool Bot 2016-12-08 13:57:10 UTC]

This issue was resolved and addressed in
 GLSA 201612-26 at https://security.gentoo.org/glsa/201612-26
by GLSA coordinator Aaron Bauman (b-man).