From secunia security advisory at $URL: Description A vulnerability has been reported in OpenJPEG, which can be exploited by malicious people to compromise an application using the library. The vulnerability is caused due to an error when parsing a CMAP record and can be exploited to cause an out-of-bounds write via specially crafted JPEG files. Successful exploitation may allow execution of arbitrary code. The vulnerability is reported in version 1.4. Prior versions may also be affected. Solution Update to version 1.5.
=media-libs/openjpeg-1.5.0 is in Portage but upstream changed SONAME (again) and the cmake based build system is poorly done so it's (again) unclear if there was a real API/ABI breakage. Please test reverse dependencies: http://qa-reports.gentoo.org/output/genrdeps/rindex/media-libs/openjpeg CCing arch's for testing/stabilization.
Stable for HPPA.
amd64 stable
x86 stable
ppc64 done
ppc done
arm stable
alpha/ia64/s390/sh/sparc stable
Thanks, everyone. Already on existing GLSA request, but waiting on bug 412895.
CVE-2012-1499 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1499): The JPEG 2000 codec in OpenJPEG before 1.5 does not properly allocate memory during file parsing, which allows remote attackers to execute arbitrary code via a crafted file.
This issue was resolved and addressed in GLSA 201206-06 at http://security.gentoo.org/glsa/glsa-201206-06.xml by GLSA coordinator Sean Amoss (ackle).
