Source: openjpeg2 Version: 2.5.3-2 Severity: important Tags: security upstream Forwarded: https://github.com/uclouvain/openjpeg/pull/1573 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for openjpeg2. CVE-2025-54874[0]: | OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG 2.5.3 and | earlier, a call to opj_jp2_read_header may lead to OOB heap memory | write when the data stream p_stream is too short and p_image is not | initialized. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2025-54874 https://www.cve.org/CVERecord?id=CVE-2025-54874 [1] https://github.com/uclouvain/openjpeg/pull/1573 [2] https://github.com/uclouvain/openjpeg/commit/f809b80c67717c152a5ad30bf06774f00da4fd2d Regards, Salvatore
