Red Hat Security AdvisoryRHSA-2013:1850
openjpeg security update
Released 2013-12-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) openjpeg-1.3-10.el6_5, openjpeg-libs-1.3-10.el6_5
- Red Hat Enterprise Linux Desktop Optional (v. 6) openjpeg-1.3-10.el6_5, openjpeg-devel-1.3-10.el6_5
- Red Hat Enterprise Linux HPC Node (v. 6) openjpeg-1.3-10.el6_5, openjpeg-libs-1.3-10.el6_5
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openjpeg-1.3-10.el6_5, openjpeg-devel-1.3-10.el6_5
- Red Hat Enterprise Linux Server (v. 6) openjpeg-1.3-10.el6_5, openjpeg-libs-1.3-10.el6_5, openjpeg-libs-1.3-10.el6_5.ppc
- Red Hat Enterprise Linux Server Optional (v. 6) openjpeg-1.3-10.el6_5, openjpeg-devel-1.3-10.el6_5, openjpeg-devel-1.3-10.el6_5.ppc
- Red Hat Enterprise Linux Workstation (v. 6) openjpeg-1.3-10.el6_5, openjpeg-libs-1.3-10.el6_5
- Red Hat Enterprise Linux Workstation Optional (v. 6) openjpeg-1.3-10.el6_5, openjpeg-devel-1.3-10.el6_5
Fixes 4 records
Priority MEDIUM 41
Multiple heap-based buffer overflows in OpenJPEG 1.3 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.05515 · Published 2013-12-12 · Fixed CWE-119
Priority LOW 37
Heap-based buffer overflow in OpenJPEG 1.3 has unspecified impact and remote vectors, a different vulnerability than CVE-2013-6045.
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.02168 · Published 2013-12-12 · Fixed CWE-119
Priority LOW 28
OpenJPEG 1.3 and earlier allows remote attackers to cause a denial of service (memory consumption or crash) via unspecified vectors related to NULL pointer dereferences, division-by-zero, and other errors.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02504 · Published 2013-12-12 · Fixed
Priority LOW 27
OpenJPEG 1.3 and earlier allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02202 · Published 2013-12-12 · Fixed CWE-200
THREATIST.IORead the docs