According to the announce on oss-security:
In convert.c:1483 and convert.c:1485, variable s is uncheck after
skip_int is called.
A null ptr will be passed to skip_int again and will cause a null ptr
# External link
(follow the link above to a patch)
there are some open issues for openjpeg that will be fixed in 2.0.2, so I guess we will bump it when available.
** RESERVED ** This candidate has been reserved by an organization or
individual that will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
//** TEMPORARY **//
OpenJpeg - variable s is uncheck after skip_int is called. A null ptr will
be passed to skip_int again and will cause a null ptr dereference.
With the permission of the Gentoo Graphics project I pushed =media-libs/openjpeg-2.1.1_p20160922 into the tree: Actually we wanted to wait for an official v2.1.2 release but upstream postponed the release for another week. Because Gentoo is still at v2.1.0 which has some critical vulnerabilities which are allowing drive-by-download attacks we decided to do a snapshot release.
This snaptshot release (based on v2.1.1) from 2016-09-22 does contain all currently published security fixes, up to CVE-2016-7445:
> commit 30e68615830631059a72b52682ab81bb8b3ca153
> Author: Thomas Deutschmann
> Date: Mon Sep 26 15:56:16 2016 +0200
> media-libs/openjpeg: Bump to snapshot release based on v2.1.1 from 2016-09-22
> Ebuild-releated changes:
> - EAPI bumped to v6
> - Test suite re-enabled and fixed (bug #409263)
> Gentoo-Bug: https://bugs.gentoo.org/409263
> Gentoo-Bug: https://bugs.gentoo.org/577608
> Gentoo-Bug: https://bugs.gentoo.org/572430
> Gentoo-Bug: https://bugs.gentoo.org/560632
> Gentoo-Bug: https://bugs.gentoo.org/594740
> Package-Manager: portage-2.3.1
please test and mark stable: =media-libs/openjpeg-2.1.1_p20160922
Stable targets: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
Stable for HPPA PPC64.
Stable on alpha.
Maintainer(s), please cleanup.
Security, please vote.
@maintainer(s), please cleanup the vulnerable versions so we can close this.
GLSA Vote: No
I forgot that maintainers (maekke) gave me permission to cleanup. Now cleaned up: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9c9cd66e0d91c68982455a355d65e4b9f3fb82f7
Added to existing GLSA.
This issue was resolved and addressed in
GLSA 201612-26 at https://security.gentoo.org/glsa/201612-26
by GLSA coordinator Aaron Bauman (b-man).