Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 640534 (CVE-2017-17479, CVE-2017-17480)

Summary: <media-libs/openjpeg-2.3.1: Multiple vulnerabilities
Product: Gentoo Security Reporter: GLSAMaker/CVETool Bot <glsamaker>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: graphics+disabled
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://github.com/uclouvain/openjpeg/pull/1160
Whiteboard: B3 [noglsa cve]
Package list:
Runtime testing required: ---
Bug Depends on: 646774    
Bug Blocks:    

Description GLSAMaker/CVETool Bot gentoo-dev 2017-12-10 16:14:22 UTC
CVE-2017-17480 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17480):
  In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the
  pgxtovolume function in jp3d/convert.c. The vulnerability causes an
  out-of-bounds write, which may lead to remote denial of service or possibly
  remote code execution.

CVE-2017-17479 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-17479):
  In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the
  pgxtoimage function in jpwl/convert.c. The vulnerability causes an
  out-of-bounds write, which may lead to remote denial of service or possibly
  remote code execution.
Comment 1 Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-12-10 16:15:24 UTC
@Maintainers please call for stabilization when ready.

Thank you
Comment 2 Andreas Sturmlechner gentoo-dev 2018-11-03 18:36:10 UTC
Tracking PR upstream.
Comment 3 Aaron Bauman (RETIRED) gentoo-dev 2019-08-02 00:19:48 UTC
cleanup will be tracked in bug #646774