Debian Security Advisory
DLA-1614-1 openjpeg2 -- LTS security update
- Date Reported:
- 22 Dec 2018
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 904873, Bug 889683.
In Mitre's CVE dictionary: CVE-2018-6616, CVE-2018-14423.
- More information:
Multiple vulnerabilities have been discovered in openjpeg2, the open-source JPEG 2000 codec.
Excessive iteration in the opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in (lib/openjp3d/pi.c). Remote attackers could leverage this vulnerability to cause a denial of service (application crash).
For Debian 8
Jessie, these problems have been fixed in version 2.1.0-2+deb8u6.
We recommend that you upgrade your openjpeg2 packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS