Multiple heap-based buffer overflows in OpenJPEG 1.3 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Revert previous changes in patch for (CVE-2016-5159)

  - Fix double free in patch for (CVE-2016-5139)

  - Fix memory leaks and invalid read in cio_bytein Related:
    #1419775

  - Add two more allocation checks to patch for     (CVE-2016-5159) Related: #1419775

  - Add patches for CVE-2016-5139, CVE-2016-5158,     (CVE-2016-5159) Related: #1419775

  - Fix patch name: CVE-2016-9675 => (CVE-2016-7163)     Related: #1419775

  - Add patch for (CVE-2016-9675)

  - Fix Coverity issues Resolves: #1419775

Security Fix(es) :

  - Multiple integer overflow flaws, leading to heap-based     buffer overflows, were found in OpenJPEG. A specially     crafted JPEG2000 image could cause an application using     OpenJPEG to crash or, potentially, execute arbitrary     code. (CVE-2016-5139, CVE-2016-5158, CVE-2016-5159,     CVE-2016-7163)

  - A vulnerability was found in the patch for CVE-2013-6045     for OpenJPEG. A specially crafted JPEG2000 image, when     read by an application using OpenJPEG, could cause     heap-based buffer overflows leading to a crash or,     potentially, arbitrary code execution. (CVE-2016-9675)

Better fix for CVE-2013-6045, that doesn't cause regressions.
Backporting from f20/f21.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201412-24 (OpenJPEG: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenJPEG. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted JPEG       file, possibly resulting in execution of arbitrary code or a Denial of       Service condition. Furthermore, a remote attacker may be able to obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

- Fixing CVE-2013-6045 without regressions

    - Adding check for invalid offsets

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Openjpeg release notes report :

That CVE-2012-3535 and CVE-2012-3358 are fixed in the 1.5.1 release.

That CVE-2013-4289, CVE-2013-4290, CVE-2013-1447, CVE-2013-6045, CVE-2013-6052, CVE-2013-6054, CVE-2013-6053, CVE-2013-6887, where fixed in the 1.5.2 release.

Multiple heap-based buffer overflow flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-6045 , CVE-2013-6054)

Multiple denial of service flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash (CVE-2013-1447 , CVE-2013-6052)

Updated openjpeg package fixes security vulnerabilities :

Multiple heap-based buffer overflow flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash or, possibly, execute arbitrary code with the privileges of the user running the application (CVE-2013-6045).

Multiple denial of service flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash (CVE-2013-1447, CVE-2013-6052, CVE-2013-6053, CVE-2013-6887).

Multiple heap-based buffer overflow flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-6045, CVE-2013-6054)

Multiple denial of service flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash (CVE-2013-1447, CVE-2013-6052)

All running applications using OpenJPEG must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:1850 advisory.

    OpenJPEG is an open source library for reading and writing image files in     JPEG 2000 format.

    Multiple heap-based buffer overflow flaws were found in OpenJPEG.
    An attacker could create a specially crafted OpenJPEG image that, when     opened, could cause an application using openjpeg to crash or, possibly,     execute arbitrary code with the privileges of the user running the     application. (CVE-2013-6045, CVE-2013-6054)

    Multiple denial of service flaws were found in OpenJPEG. An attacker could     create a specially crafted OpenJPEG image that, when opened, could cause an     application using openjpeg to crash (CVE-2013-1447, CVE-2013-6052)

    Red Hat would like to thank Raphael Geissert for reporting these issues.

    Users of OpenJPEG are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. All running     applications using OpenJPEG must be restarted for the update to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2013:1850 :

Updated openjpeg packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenJPEG is an open source library for reading and writing image files in JPEG 2000 format.

Multiple heap-based buffer overflow flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-6045, CVE-2013-6054)

Multiple denial of service flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash (CVE-2013-1447, CVE-2013-6052)

Red Hat would like to thank Raphael Geissert for reporting these issues.

Users of OpenJPEG are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using OpenJPEG must be restarted for the update to take effect.

Updated openjpeg packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

OpenJPEG is an open source library for reading and writing image files in JPEG 2000 format.

Multiple heap-based buffer overflow flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-6045, CVE-2013-6054)

Multiple denial of service flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash (CVE-2013-1447, CVE-2013-6052)

Red Hat would like to thank Raphael Geissert for reporting these issues.

Users of OpenJPEG are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using OpenJPEG must be restarted for the update to take effect.

Fix CVE-2013-6045 CVE-2013-6052 CVE-2013-6053

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in OpenJPEG, a JPEG 2000 image library, that may lead to denial of service (CVE-2013-1447 ) via application crash or high memory consumption, possible code execution through heap buffer overflows (CVE-2013-6045 ), information disclosure (CVE-2013-6052 ), or yet another heap buffer overflow that only appears to affect OpenJPEG 1.3 (CVE-2013-6054 ).

ID	Name	Product	Family	Severity
97908	OracleVM 3.3 / 3.4 : openjpeg (OVMSA-2017-0048)	Nessus	OracleVM Local Security Checks	high
97846	Scientific Linux Security Update : openjpeg on SL6.x i386/x86_64 (20170319)	Nessus	Scientific Linux Local Security Checks	high
80339	Fedora 19 : openjpeg-1.5.1-13.fc19 (2014-17053)	Nessus	Fedora Local Security Checks	high
79977	GLSA-201412-24 : OpenJPEG: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
78403	Fedora 20 : openjpeg-1.5.1-13.fc20 (2014-12507)	Nessus	Fedora Local Security Checks	high
78382	Fedora 21 : openjpeg-1.5.1-13.fc21 (2014-12458)	Nessus	Fedora Local Security Checks	high
74176	FreeBSD : openjpeg -- Multiple vulnerabilities (02db20d7-e34a-11e3-bd92-bcaec565249c)	Nessus	FreeBSD Local Security Checks	critical
72289	Amazon Linux AMI : openjpeg (ALAS-2014-271)	Nessus	Amazon Linux Local Security Checks	high
72022	Mandriva Linux Security Advisory : openjpeg (MDVSA-2014:008)	Nessus	Mandriva Local Security Checks	high
71517	Scientific Linux Security Update : openjpeg on SL6.x i386/x86_64 (20131217)	Nessus	Scientific Linux Local Security Checks	high
71516	RHEL 6 : openjpeg (RHSA-2013:1850)	Nessus	Red Hat Local Security Checks	high
71513	Oracle Linux 6 : openjpeg (ELSA-2013-1850)	Nessus	Oracle Linux Local Security Checks	high
71501	CentOS 6 : openjpeg (CESA-2013:1850)	Nessus	CentOS Local Security Checks	high
71445	Fedora 19 : mingw-openjpeg-1.5.1-5.fc19 (2013-22914)	Nessus	Fedora Local Security Checks	high
71444	Fedora 20 : mingw-openjpeg-1.5.1-5.fc20 (2013-22827)	Nessus	Fedora Local Security Checks	high
71180	Debian DSA-2808-1 : openjpeg - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2013-6045

high

Tenable Plugins

high

high

high

critical

high

high

critical

high

high

high

high

high

high

high

high

high