Executive Summary
Informations | |||
---|---|---|---|
Name | MDVSA-2013:110 | First vendor Publication | 2013-04-10 |
Vendor | Mandriva | Last vendor Modification | 2013-04-10 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 10 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Updated openjpeg packages fix security vulnerability: An out-of heap-based buffer bounds read and write flaw, leading to invalid free, was found in the way a tile coder / decoder (TCD) implementation of OpenJPEG, an open-source JPEG 2000 codec written in C language, performed releasing of previously allocated memory for the TCD encoder handle by processing certain Gray16 TIFF images. A remote attacker could provide a specially-crafted TIFF image file, which once converted into the JPEG 2000 file format with an application linked against OpenJPEG (such as 'image_to_j2k'), would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application (CVE-2009-5030). An input validation flaw, leading to a heap-based buffer overflow, was found in the way OpenJPEG handled the tile number and size in an image tile header. A remote attacker could provide a specially-crafted image file that, when decoded using an application linked against OpenJPEG, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2012-3358). It was found that OpenJPEG failed to sanity-check an image header field before using it. A remote attacker could provide a specially-crafted image file that could cause an application linked against OpenJPEG to crash or, possibly, execute arbitrary code (CVE-2012-3535). |
Original Source
Url : http://www.mandriva.com/security/advisories?name=MDVSA-2013:110 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:18382 | |||
Oval ID: | oval:org.mitre.oval:def:18382 | ||
Title: | DSA-2629-1 openjpeg - several issues | ||
Description: | Heap memory corruption leading to invalid free when processing certain Gray16 TIFF images. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2629-1 CVE-2009-5030 CVE-2012-3358 CVE-2012-3535 | Version: | 7 |
Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | openjpeg |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:21480 | |||
Oval ID: | oval:org.mitre.oval:def:21480 | ||
Title: | RHSA-2012:1283: openjpeg security update (Important) | ||
Description: | Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted JPEG2000 file. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2012:1283-01 CESA-2012:1283 CVE-2012-3535 | Version: | 4 |
Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | openjpeg |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:21505 | |||
Oval ID: | oval:org.mitre.oval:def:21505 | ||
Title: | RHSA-2012:1068: openjpeg security update (Important) | ||
Description: | Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2012:1068-01 CESA-2012:1068 CVE-2009-5030 CVE-2012-3358 | Version: | 29 |
Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | openjpeg |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:23856 | |||
Oval ID: | oval:org.mitre.oval:def:23856 | ||
Title: | ELSA-2012:1283: openjpeg security update (Important) | ||
Description: | Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted JPEG2000 file. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2012:1283-01 CVE-2012-3535 | Version: | 6 |
Platform(s): | Oracle Linux 6 | Product(s): | openjpeg |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:23900 | |||
Oval ID: | oval:org.mitre.oval:def:23900 | ||
Title: | ELSA-2012:1068: openjpeg security update (Important) | ||
Description: | Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2012:1068-01 CVE-2009-5030 CVE-2012-3358 | Version: | 13 |
Platform(s): | Oracle Linux 6 | Product(s): | openjpeg |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27724 | |||
Oval ID: | oval:org.mitre.oval:def:27724 | ||
Title: | DEPRECATED: ELSA-2012-1068 -- openjpeg security update (important) | ||
Description: | [1.3-8] - Apply patches for CVE-2009-5030, CVE-2012-3358 Resolves: #831561 - Include -DCMAKE_INSTALL_LIBDIR in cmake call; fixes FTBFS with recent versions of cmake | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2012-1068 CVE-2009-5030 CVE-2012-3358 | Version: | 4 |
Platform(s): | Oracle Linux 6 | Product(s): | openjpeg |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27820 | |||
Oval ID: | oval:org.mitre.oval:def:27820 | ||
Title: | DEPRECATED: ELSA-2012-1283 -- openjpeg security update (important) | ||
Description: | [1.3-9] - Apply patch for CVE-2012-3535 Resolves: CVE-2012-3535 | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2012-1283 CVE-2012-3535 | Version: | 4 |
Platform(s): | Oracle Linux 6 | Product(s): | openjpeg |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 5 |
OpenVAS Exploits
Date | Description |
---|---|
2012-11-02 | Name : Fedora Update for openjpeg FEDORA-2012-14717 File : nvt/gb_fedora_2012_14717_openjpeg_fc17.nasl |
2012-10-23 | Name : Fedora Update for openjpeg FEDORA-2012-14707 File : nvt/gb_fedora_2012_14707_openjpeg_fc16.nasl |
2012-10-05 | Name : Mandriva Update for openjpeg MDVSA-2012:157 (openjpeg) File : nvt/gb_mandriva_MDVSA_2012_157.nasl |
2012-09-22 | Name : CentOS Update for openjpeg CESA-2012:1283 centos6 File : nvt/gb_CESA-2012_1283_openjpeg_centos6.nasl |
2012-09-22 | Name : RedHat Update for openjpeg RHSA-2012:1283-01 File : nvt/gb_RHSA-2012_1283-01_openjpeg.nasl |
2012-08-30 | Name : Fedora Update for openjpeg FEDORA-2012-9602 File : nvt/gb_fedora_2012_9602_openjpeg_fc17.nasl |
2012-07-30 | Name : CentOS Update for openjpeg CESA-2012:1068 centos6 File : nvt/gb_CESA-2012_1068_openjpeg_centos6.nasl |
2012-07-16 | Name : RedHat Update for openjpeg RHSA-2012:1068-01 File : nvt/gb_RHSA-2012_1068-01_openjpeg.nasl |
2012-07-16 | Name : Mandriva Update for openjpeg MDVSA-2012:104 (openjpeg) File : nvt/gb_mandriva_MDVSA_2012_104.nasl |
2012-06-28 | Name : Fedora Update for openjpeg FEDORA-2012-9628 File : nvt/gb_fedora_2012_9628_openjpeg_fc16.nasl |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-717.nasl - Type : ACT_GATHER_INFO |
2014-05-26 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_02db20d7e34a11e3bd92bcaec565249c.nasl - Type : ACT_GATHER_INFO |
2013-10-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201310-07.nasl - Type : ACT_GATHER_INFO |
2013-09-04 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2012-125.nasl - Type : ACT_GATHER_INFO |
2013-09-04 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2012-111.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-1283.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-1068.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Fedora host is missing a security update. File : fedora_2013-8953.nasl - Type : ACT_GATHER_INFO |
2013-04-20 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-110.nasl - Type : ACT_GATHER_INFO |
2013-02-26 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2629.nasl - Type : ACT_GATHER_INFO |
2012-11-02 | Name : The remote Fedora host is missing a security update. File : fedora_2012-14717.nasl - Type : ACT_GATHER_INFO |
2012-10-23 | Name : The remote Fedora host is missing a security update. File : fedora_2012-14707.nasl - Type : ACT_GATHER_INFO |
2012-10-16 | Name : The remote Fedora host is missing a security update. File : fedora_2012-14664.nasl - Type : ACT_GATHER_INFO |
2012-10-04 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2012-157.nasl - Type : ACT_GATHER_INFO |
2012-09-18 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-1283.nasl - Type : ACT_GATHER_INFO |
2012-09-18 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120917_openjpeg_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2012-09-18 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-1283.nasl - Type : ACT_GATHER_INFO |
2012-08-16 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2012-104.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120711_openjpeg_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2012-07-13 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-1068.nasl - Type : ACT_GATHER_INFO |
2012-07-12 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-1068.nasl - Type : ACT_GATHER_INFO |
2012-06-28 | Name : The remote Fedora host is missing a security update. File : fedora_2012-9628.nasl - Type : ACT_GATHER_INFO |
2012-06-28 | Name : The remote Fedora host is missing a security update. File : fedora_2012-9602.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:43:38 |
|
2013-04-10 17:18:22 |
|