PT-2012-1162 · Openjpeg+3 · Openjpeg+3

Huzaifa Sidhpurwala · Published 2012-07-11 · Updated 2023-02-13 · CVE-2009-5030

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenJPEG versions 1.3 through 1.5

Description The issue allows remote attackers to cause a denial of service and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image. This is due to the tcd free encode function in tcd.c causing insufficient memory to be allocated, leading to an "invalid free." The vulnerability can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information.

Recommendations For OpenJPEG versions 1.3 through 1.5, update to version 1.5.1 or later to resolve the issue. At the moment, there is no information about other specific fixes for this vulnerability.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2019-2337

ALT-PU-2021-1097

ALT-PU-2021-1197

BDU:2015-09686

CESA-2012_1068

CVE-2009-5030

DSA-2629-1

RHSA-2012:1068

RHSA-2012_1068

Affected Products

Alt Linux

Centos

Openjpeg

Red Hat

References · 55

• http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08987 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-5030 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9675 · Security Note
• https://bdu.fstec.ru/vul/2021-03505 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6052 · Security Note
• https://bdu.fstec.ru/vul/2015-06457 · Security Note
• https://bdu.fstec.ru/vul/2015-09665 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4290 · Security Note
• https://bdu.fstec.ru/vul/2015-09772 · Security Note
• https://errata.altlinux.org/ALT-PU-2021-1097 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1068.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4289 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6054 · Security Note
• https://bdu.fstec.ru/vul/2015-08988 · Security Note