CVE-2014-7945

Published: 22 January 2015

OpenJPEG before r2908, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document, related to j2k.c, jp2.c, and t2.c.

Priority

Medium

Status

Package Release Status
chromium-browser
Launchpad, Ubuntu, Debian
Upstream
Released (40.0.2214.91)
Ubuntu 21.04 (Hirsute Hippo)
Released (40.0.2214.94-0ubuntu1.1120)
Ubuntu 20.10 (Groovy Gorilla)
Released (40.0.2214.94-0ubuntu1.1120)
Ubuntu 20.04 LTS (Focal Fossa)
Released (40.0.2214.94-0ubuntu1.1120)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (40.0.2214.94-0ubuntu1.1120)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (40.0.2214.94-0ubuntu1.1120)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was released [40.0.2214.94-0ubuntu0.14.04.1.1068])
gdcm
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(uses system openjpeg)
Ubuntu 20.10 (Groovy Gorilla) Not vulnerable
(uses system openjpeg)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(uses system openjpeg)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(uses system openjpeg)
Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(uses system openjpeg)
Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable
(uses system openjpeg)
insighttoolkit4
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 21.04 (Hirsute Hippo) Not vulnerable

Ubuntu 20.10 (Groovy Gorilla) Not vulnerable

Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable

Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable

Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was needed)
openjpeg
Launchpad, Ubuntu, Debian
Upstream
Released (2.1.1)
Ubuntu 21.04 (Hirsute Hippo) Does not exist

Ubuntu 20.10 (Groovy Gorilla) Does not exist

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(code not present)
Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable
(code not present)
openjpeg2
Launchpad, Ubuntu, Debian
Upstream
Released (2.1.1)
Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(2.1.1-1)
Ubuntu 20.10 (Groovy Gorilla) Not vulnerable
(2.1.1-1)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(2.1.1-1)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(2.1.1-1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (2.1.2-1.1+deb9u2build0.1)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

Patches:
Upstream: https://github.com/uclouvain/openjpeg/commit/0b540067b18a75af6a1640b2ffb8ceb5f08be6d2
Upstream: https://github.com/uclouvain/openjpeg/commit/f8796711e8d8e004d8b73929f0ff87c83abf0c76
Upstream: https://github.com/uclouvain/openjpeg/commit/3df347eded5e0b690b1de72c48136ebbcfeef527
Upstream: https://github.com/uclouvain/openjpeg/commit/efb70af001401c2cf3e9e60e308225ceb95ae9b6
Upstream: https://github.com/uclouvain/openjpeg/commit/0a3f234df7b95ca3ac7e3d3a3019d24cb4cf5a83
Upstream: https://github.com/uclouvain/openjpeg/commit/eb7c6d295aa77279b06d91c84b359f739a9e25bd
Upstream: https://github.com/uclouvain/openjpeg/commit/7256e43c48ba5f7b1b8ee2927a52dc783a7ab3ed
Upstream: https://github.com/uclouvain/openjpeg/commit/e65303b90336b5ec22b3ccafddba731d1228f370
Upstream: https://github.com/uclouvain/openjpeg/commit/f126eb0d41f475ed80190c94a071f59839b9a205
oxide-qt
Launchpad, Ubuntu, Debian
Upstream Not vulnerable

Ubuntu 21.04 (Hirsute Hippo) Does not exist

Ubuntu 20.10 (Groovy Gorilla) Does not exist

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was not-affected)
vxl
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 21.04 (Hirsute Hippo) Does not exist

Ubuntu 20.10 (Groovy Gorilla) Does not exist

Ubuntu 20.04 LTS (Focal Fossa) Does not exist

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 ESM (Xenial Xerus) Ignored
(end of standard support, was needed)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was needed)