Solution
Please Install the Updated Packages.
Insight
OpenJPEG is an open source library for reading and writing image files in JPEG 2000 format.
Multiple heap-based buffer overflow flaws were found in OpenJPEG.
An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-6045, CVE-2013-6054)
Multiple denial of service flaws were found in OpenJPEG. An attacker could create a specially crafted OpenJPEG image that, when opened, could cause an application using openjpeg to crash (CVE-2013-1447, CVE-2013-6052)
Red Hat would like to thank Raphael Geissert for reporting these issues.
Users of OpenJPEG are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using OpenJPEG must be restarted for the update to take effect.
Affected
openjpeg on Red Hat Enterprise Linux Desktop (v. 6), Red Hat Enterprise Linux Server (v. 6),
Red Hat Enterprise Linux Workstation (v. 6)
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2013-1447, CVE-2013-6045, CVE-2013-6052, CVE-2013-6054 -
CVSS Base Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities