SB2019082113 - Ubuntu update for OpenJPEG

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Memory corruption (CVE-ID: CVE-2017-17480)

The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.

The vulnerability exists due to stack-based buffer overflow in the pgxtoimage function in jpwl/convert.c. A remote unauthenticated attacker can trigger memory corruption that leads to out-of-bounds write and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Divide-by-zero (CVE-ID: CVE-2018-14423)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to multiple division-by-zero conditions that exist in the pi_next_pcrl, pi_next_cprl, and pi_next_rpcl functions, as defined in the lib/openjp3d/pi.c source code file. A remote attacker can trick the victim into opening a specially crafted file with an application that uses the affected library and cause the affected application to crash.

3) NULL pointer dereference (CVE-ID: CVE-2018-18088)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error in the imagetopnm function of jp2/convert. A remote attacker can perform a denial of service (DoS) attack.

4) Integer overflow (CVE-ID: CVE-2018-5785)

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to integer overflow in opj_j2k_setup_encoder function (openjp2/j2k.c). A remote attacker can create a specially crafted bmp image, trigger integer overflow and crash the affected application.

5) Improper input validation (CVE-ID: CVE-2018-6616)

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the opj_t1_encode_cblks function, which is defined in the openjp2/t1.c source code file, due to insufficient validation of user-supplied input. A local attacker can submit a specially crafted BMP file and cause the service to crash.

Remediation

Install update from vendor's website.

References

• https://usn.ubuntu.com/4109-1/