Source: openjpeg2 Version: 2.1.2-1.3 Severity: grave Tags: security upstream patch Forwarded: https://github.com/uclouvain/openjpeg/issues/982
Hi, the following vulnerability was published for openjpeg2. CVE-2017-14151[0]: | An off-by-one error was discovered in | opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd.c in OpenJPEG | 2.2.0. The vulnerability causes an out-of-bounds write, which may lead | to remote denial of service (heap-based buffer overflow affecting | opj_mqc_flush in lib/openjp2/mqc.c and opj_t1_encode_cblk in | lib/openjp2/t1.c) or possibly remote code execution. Verifiable with an ASAN build of openjpeg2. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2017-14151 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14151 [1] https://github.com/uclouvain/openjpeg/issues/982 [2] https://blogs.gentoo.org/ago/2017/08/16/openjpeg-heap-based-buffer-overflow-in-opj_mqc_flush-mqc-c/ Please adjust the affected versions in the BTS as needed. Regards, Salvatore
