A heap-based buffer overflow was found in the way OpenJPEG, an
open-source JPEG 2000 codec written in C language, performed parsing of
JPEG2000 having certain number of tiles and tilesizes. A remote
attacker could provide a specially crafted JPEG 2000 file, which when
opened in an application linked against openjpeg would lead to that
application crash, or, potentially arbitrary code execution with the
privileges of the user running the application.
This issue has been assigned CVE-2012-3358
Thanks for the report
Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c
in OpenJPEG 1.5 allow remote attackers to cause a denial of service
(application crash) and possibly execute arbitrary code via a crafted (1)
tile number or (2) tile length in a JPEG 2000 image file.
GLSA request filed.
This issue was resolved and addressed in
GLSA 201310-07 at http://security.gentoo.org/glsa/glsa-201310-07.xml
by GLSA coordinator Sean Amoss (ackle).