SB2017091003 - Fedora 27 update for openjpeg2

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2017-12982)

The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.

The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service (memory allocation failure) in the opj_image_create function in lib/openjp2/image.c, related to the opj_aligned_alloc_n function in opj_malloc.c.

2) Out-of-bounds write (CVE-ID: CVE-2017-14040)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact.

3) Out-of-bounds write (CVE-ID: CVE-2017-14041)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.

4) Out-of-bounds write (CVE-ID: CVE-2017-14152)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c and opj_j2k_write_sot in lib/openjp2/j2k.c) or possibly remote code execution.

5) Buffer overflow (CVE-ID: CVE-2017-14151)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_mqc_flush in lib/openjp2/mqc.c and opj_t1_encode_cblk in lib/openjp2/t1.c) or possibly remote code execution.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2017-a5bb95b447