Buffer overflow in OpenJPEG - CVE-2009-5030
Published: July 19, 2012 / Updated: August 11, 2020
Vulnerability identifier: #VU43841
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2009-5030
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."
Affected software
OpenJPEG
Amazon Linux AMI
Gentoo Linux
Amazon Linux AMI
Gentoo Linux
How to mitigate CVE-2009-5030
Install update from vendor's website.
External References
- http://code.google.com/p/openjpeg/issues/detail?id=5
- http://code.google.com/p/openjpeg/source/detail?r=1703
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html
- http://rhn.redhat.com/errata/RHSA-2012-1068.html
- http://secunia.com/advisories/48781
- http://secunia.com/advisories/49913
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:104
- http://www.openwall.com/lists/oss-security/2012/04/13/5
- http://www.securityfocus.com/bid/53012
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74851
- https://groups.google.com/forum/#!topic/openjpeg/DLVrRKbTeI0/discussion