USN-4497-1: OpenJPEG vulnerabilities
15 September 2020
Several security issues were fixed in OpenJPEG.
Releases
Packages
- openjpeg2 - Open-source JPEG 2000 codec written in C language
Details
It was discovered that OpenJPEG incorrectly handled certain image files. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2016-9112)
It was discovered that OpenJPEG did not properly handle certain input. If
OpenJPEG were supplied with specially crafted input, it could be made to crash
or potentially execute arbitrary code.
(CVE-2018-20847, CVE-2018-21010, CVE-2020-6851, CVE-2020-8112, CVE-2020-15389)
It was discovered that OpenJPEG incorrectly handled certain BMP files. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2019-12973)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04
-
libopenjp2-7
-
2.1.2-1.1+deb9u5build0.16.04.1
-
libopenjp2-tools
-
2.1.2-1.1+deb9u5build0.16.04.1
-
libopenjp3d-tools
-
2.1.2-1.1+deb9u5build0.16.04.1
-
libopenjp3d7
-
2.1.2-1.1+deb9u5build0.16.04.1
-
libopenjpip-dec-server
-
2.1.2-1.1+deb9u5build0.16.04.1
-
libopenjpip-server
-
2.1.2-1.1+deb9u5build0.16.04.1
-
libopenjpip-viewer
-
2.1.2-1.1+deb9u5build0.16.04.1
-
libopenjpip7
-
2.1.2-1.1+deb9u5build0.16.04.1
In general, a standard system update will make all the necessary changes.
Related notices
- USN-4782-1: libopenjp2-7-dev, libopenjp2-tools, libopenjpip-server, openjpeg2, libopenjpip-dec-server, libopenjp2-7, libopenjp3d7, libopenjpip7, libopenjpip-viewer, libopenjp3d-tools
- USN-4686-1: ghostscript-x, libgs-dev, ghostscript, libgs9, libgs9-common, ghostscript-doc
- USN-5952-1: libopenjp2-7-dev, libopenjp2-tools, libopenjpip-server, openjpeg2, libopenjpip-dec-server, libopenjp2-7, libopenjp3d7, libopenjpip7, libopenjpip-viewer, libopenjp3d-tools
- USN-4685-1: libopenjp2-7-dev, libopenjp2-tools, libopenjpip-server, openjpeg2, libopenjpip-dec-server, libopenjp2-7, libopenjp3d7, libopenjpip7, libopenjpip-viewer, libopenjp3d-tools
- USN-5664-1: libopenjpeg5, libopenjpeg-java, openjpeg-tools, libopenjpeg-dev, openjpip-server, openjpip-dec-server, openjpip-viewer-xerces, openjpip-viewer, openjpeg