[ GLSA 201710-26 ] OpenJPEG

[GLSA]

Gentoo Linux Security Advisory

Title: OpenJPEG: Multiple vulnerabilities (GLSA 201710-26)
Severity: normal
Exploitable: remote
Date: 2017-10-23
Bug(s): #602180, #606618, #628504, #629372, #629668, #630120
ID: 201710-26

Synopsis

Multiple vulnerabilities have been found in OpenJPEG, the worst of
which may allow remote attackers to execute arbitrary code.


Background

OpenJPEG is an open-source JPEG 2000 library.

Affected Packages

Package: media-libs/openjpeg
Vulnerable: < 2.3.0
Unaffected: >= 2.3.0
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in OpenJPEG. Please review
the references below for details.


Impact

A remote attacker, via a crafted BMP, PDF, or j2k document, could
execute arbitrary code, cause a Denial of Service condition, or have
other unspecified impacts.


Workaround

There is no known workaround at this time.

Resolution

All OpenJPEG users should upgrade to the latest version: