Synopsis:          Moderate: openjpeg security update

Advisory ID:       SLSA-2017:0559-1

Issue Date:        2017-03-19

CVE Numbers:       CVE-2016-5139

                   CVE-2016-5158

                   CVE-2016-5159

                   CVE-2016-7163

                   CVE-2016-9675

--



Security Fix(es):



* Multiple integer overflow flaws, leading to heap-based buffer overflows,

were found in OpenJPEG. A specially crafted JPEG2000 image could cause an

application using OpenJPEG to crash or, potentially, execute arbitrary

code. (CVE-2016-5139, CVE-2016-5158, CVE-2016-5159, CVE-2016-7163)



* A vulnerability was found in the patch for CVE-2013-6045 for OpenJPEG. A

specially crafted JPEG2000 image, when read by an application using

OpenJPEG, could cause heap-based buffer overflows leading to a crash or,

potentially, arbitrary code execution. (CVE-2016-9675)

--



SL6

  x86_64

    openjpeg-debuginfo-1.3-16.el6_8.i686.rpm

    openjpeg-debuginfo-1.3-16.el6_8.x86_64.rpm

    openjpeg-libs-1.3-16.el6_8.i686.rpm

    openjpeg-libs-1.3-16.el6_8.x86_64.rpm

    openjpeg-1.3-16.el6_8.x86_64.rpm

    openjpeg-devel-1.3-16.el6_8.i686.rpm

    openjpeg-devel-1.3-16.el6_8.x86_64.rpm

  i386

    openjpeg-debuginfo-1.3-16.el6_8.i686.rpm

    openjpeg-libs-1.3-16.el6_8.i686.rpm

    openjpeg-1.3-16.el6_8.i686.rpm

    openjpeg-devel-1.3-16.el6_8.i686.rpm



- Scientific Linux Development Team