Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2012:104 | First vendor Publication | 2012-07-12 |
| Vendor | Mandriva | Last vendor Modification | 2012-07-12 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple vulnerabilities has been discovered and corrected in openjpeg: OpenJPEG allocated insufficient memory when encoding JPEG 2000 files from input images that have certain color depths. A remote attacker could provide a specially-crafted image file that, when opened in an application linked against OpenJPEG (such as image_to_j2k), would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2009-5030). An input validation flaw, leading to a heap-based buffer overflow, was found in the way OpenJPEG handled the tile number and size in an image tile header. A remote attacker could provide a specially-crafted image file that, when decoded using an application linked against OpenJPEG, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2012-3358). The updated packages have been patched to correct these issues. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2012:104 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:21505 | |||
| Oval ID: | oval:org.mitre.oval:def:21505 | ||
| Title: | RHSA-2012:1068: openjpeg security update (Important) | ||
| Description: | Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2012:1068-01 CESA-2012:1068 CVE-2009-5030 CVE-2012-3358 | Version: | 29 |
| Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | openjpeg |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:23900 | |||
| Oval ID: | oval:org.mitre.oval:def:23900 | ||
| Title: | ELSA-2012:1068: openjpeg security update (Important) | ||
| Description: | Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012:1068-01 CVE-2009-5030 CVE-2012-3358 | Version: | 13 |
| Platform(s): | Oracle Linux 6 | Product(s): | openjpeg |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27724 | |||
| Oval ID: | oval:org.mitre.oval:def:27724 | ||
| Title: | DEPRECATED: ELSA-2012-1068 -- openjpeg security update (important) | ||
| Description: | [1.3-8] - Apply patches for CVE-2009-5030, CVE-2012-3358 Resolves: #831561 - Include -DCMAKE_INSTALL_LIBDIR in cmake call; fixes FTBFS with recent versions of cmake | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012-1068 CVE-2009-5030 CVE-2012-3358 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | openjpeg |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 3 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-11-02 | Name : Fedora Update for openjpeg FEDORA-2012-14717 File : nvt/gb_fedora_2012_14717_openjpeg_fc17.nasl |
| 2012-10-23 | Name : Fedora Update for openjpeg FEDORA-2012-14707 File : nvt/gb_fedora_2012_14707_openjpeg_fc16.nasl |
| 2012-08-30 | Name : Fedora Update for openjpeg FEDORA-2012-9602 File : nvt/gb_fedora_2012_9602_openjpeg_fc17.nasl |
| 2012-07-30 | Name : CentOS Update for openjpeg CESA-2012:1068 centos6 File : nvt/gb_CESA-2012_1068_openjpeg_centos6.nasl |
| 2012-07-16 | Name : RedHat Update for openjpeg RHSA-2012:1068-01 File : nvt/gb_RHSA-2012_1068-01_openjpeg.nasl |
| 2012-07-16 | Name : Mandriva Update for openjpeg MDVSA-2012:104 (openjpeg) File : nvt/gb_mandriva_MDVSA_2012_104.nasl |
| 2012-06-28 | Name : Fedora Update for openjpeg FEDORA-2012-9628 File : nvt/gb_fedora_2012_9628_openjpeg_fc16.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-05-26 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_02db20d7e34a11e3bd92bcaec565249c.nasl - Type : ACT_GATHER_INFO |
| 2013-10-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201310-07.nasl - Type : ACT_GATHER_INFO |
| 2013-09-04 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2012-111.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Fedora host is missing a security update. File : fedora_2013-8953.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-1068.nasl - Type : ACT_GATHER_INFO |
| 2013-04-20 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-110.nasl - Type : ACT_GATHER_INFO |
| 2013-02-26 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2629.nasl - Type : ACT_GATHER_INFO |
| 2012-08-16 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2012-104.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120711_openjpeg_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2012-07-13 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-1068.nasl - Type : ACT_GATHER_INFO |
| 2012-07-12 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-1068.nasl - Type : ACT_GATHER_INFO |
| 2012-06-28 | Name : The remote Fedora host is missing a security update. File : fedora_2012-9602.nasl - Type : ACT_GATHER_INFO |
| 2012-06-28 | Name : The remote Fedora host is missing a security update. File : fedora_2012-9628.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:43:00 |
|
