OpenJPEG 1.5.1 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read.

Better fix for CVE-2013-6045, that doesn't cause regressions.
Backporting from f20/f21.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201412-24 (OpenJPEG: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenJPEG. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted JPEG       file, possibly resulting in execution of arbitrary code or a Denial of       Service condition. Furthermore, a remote attacker may be able to obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

Openjpeg release notes report :

That CVE-2012-3535 and CVE-2012-3358 are fixed in the 1.5.1 release.

That CVE-2013-4289, CVE-2013-4290, CVE-2013-1447, CVE-2013-6045, CVE-2013-6052, CVE-2013-6054, CVE-2013-6053, CVE-2013-6887, where fixed in the 1.5.2 release.

A plethora of security updates.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated openjpeg package fixes security vulnerabilities :

Multiple heap-based buffer overflow flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash or, possibly, execute arbitrary code with the privileges of the user running the application (CVE-2013-6045).

Multiple denial of service flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash (CVE-2013-1447, CVE-2013-6052, CVE-2013-6053, CVE-2013-6887).

Fix CVE-2013-6045 CVE-2013-6052 CVE-2013-6053

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80339	Fedora 19 : openjpeg-1.5.1-13.fc19 (2014-17053)	Nessus	Fedora Local Security Checks	high
79977	GLSA-201412-24 : OpenJPEG: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
74176	FreeBSD : openjpeg -- Multiple vulnerabilities (02db20d7-e34a-11e3-bd92-bcaec565249c)	Nessus	FreeBSD Local Security Checks	critical
72221	Fedora 19 : openjpeg-1.5.1-8.fc19 (2014-0719)	Nessus	Fedora Local Security Checks	medium
72022	Mandriva Linux Security Advisory : openjpeg (MDVSA-2014:008)	Nessus	Mandriva Local Security Checks	high
71959	Fedora 20 : openjpeg-1.5.1-8.fc20 (2014-0708)	Nessus	Fedora Local Security Checks	medium
71445	Fedora 19 : mingw-openjpeg-1.5.1-5.fc19 (2013-22914)	Nessus	Fedora Local Security Checks	high
71444	Fedora 20 : mingw-openjpeg-1.5.1-5.fc20 (2013-22827)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2013-6053

high

Tenable Plugins

high

critical

critical

medium

high

medium

high

high