--- title: "CVE-2015-1273\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2015-1273?format=md keywords: index, follow --- # CVE-2015-1273 Publication date 23 July 2015 Last updated 24 July 2024 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid JPEG2000 data in a PDF document. [Read the notes from the security team](https://ubuntu.com/security/CVE-2015-1273?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | openjpeg | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 19.10 eoan | Not in release | | 19.04 disco | Not in release | | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 17.10 artful | Not in release | | 17.04 zesty | Not in release | | 16.10 yakkety | Ignored end of life | | 16.04 LTS xenial | Vulnerable, fix deferred | | 15.10 wily | Ignored end of life | | 15.04 vivid | Ignored end of life, was deferred | | 14.04 LTS trusty | Vulnerable, fix deferred | | 12.04 LTS precise | Ignored end of life | | chromium-browser | 26.04 LTS resolute | Fixed 44.0.2403.89-0ubuntu1.1195 | | 25.10 questing | Fixed 44.0.2403.89-0ubuntu1.1195 | | 25.04 plucky | Fixed 44.0.2403.89-0ubuntu1.1195 | | 24.10 oracular | Fixed 44.0.2403.89-0ubuntu1.1195 | | 24.04 LTS noble | Fixed 44.0.2403.89-0ubuntu1.1195 | | 23.10 mantic | Fixed 44.0.2403.89-0ubuntu1.1195 | | 23.04 lunar | Fixed 44.0.2403.89-0ubuntu1.1195 | | 22.10 kinetic | Fixed 44.0.2403.89-0ubuntu1.1195 | | 22.04 LTS jammy | Fixed 44.0.2403.89-0ubuntu1.1195 | | 21.10 impish | Fixed 44.0.2403.89-0ubuntu1.1195 | | 21.04 hirsute | Fixed 44.0.2403.89-0ubuntu1.1195 | | 20.10 groovy | Fixed 44.0.2403.89-0ubuntu1.1195 | | 20.04 LTS focal | Fixed 44.0.2403.89-0ubuntu1.1195 | | 19.10 eoan | Fixed 44.0.2403.89-0ubuntu1.1195 | | 19.04 disco | Fixed 44.0.2403.89-0ubuntu1.1195 | | 18.10 cosmic | Fixed 44.0.2403.89-0ubuntu1.1195 | | 18.04 LTS bionic | Fixed 44.0.2403.89-0ubuntu1.1195 | | 17.10 artful | Fixed 44.0.2403.89-0ubuntu1.1195 | | 17.04 zesty | Fixed 44.0.2403.89-0ubuntu1.1195 | | 16.10 yakkety | Fixed 44.0.2403.89-0ubuntu1.1195 | | 16.04 LTS xenial | Fixed 44.0.2403.89-0ubuntu1.1195 | | 15.10 wily | Fixed 44.0.2403.89-0ubuntu1.1195 | | 15.04 vivid | Fixed 44.0.2403.89-0ubuntu0.15.04.1.1177 | | 14.10 utopic | Ignored end of life, was needed | | 14.04 LTS trusty | Fixed 44.0.2403.89-0ubuntu0.14.04.1.1095 | | 12.04 LTS precise | Ignored | | oxide-qt | 26.04 LTS resolute | Not in release | | 25.10 questing | Not in release | | 25.04 plucky | Not in release | | 24.10 oracular | Not in release | | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 19.10 eoan | Not in release | | 19.04 disco | Not in release | | 18.10 cosmic | Not in release | | 18.04 LTS bionic | Not in release | | 17.10 artful | Not affected | | 17.04 zesty | Not affected | | 16.10 yakkety | Not affected | | 16.04 LTS xenial | Not affected | | 15.10 wily | Not affected | | 15.04 vivid | Not affected | | 14.10 utopic | Not affected | | 14.04 LTS trusty | Not in release | | 12.04 LTS precise | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) * [Patch details](https://ubuntu.com/security/CVE-2015-1273?format=md#patch-details) ## Notes --- ### [tyhicks](https://launchpad.net/~tyhicks) There are large changes between openjpeg trunk and the 1.5 and 1.3 branches that we shipped in Vivid and older. However, it looks like those code bases are also affected because I don't see similar sanity checks. As of 2015-07-24, I don't see a fix in the 1.5 branch. ### Patch details For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) | Package | Patch details | | --- | --- | | openjpeg | * Upstream: [daed8cc](https://github.com/uclouvain/openjpeg/commit/daed8cc9195555e101ab708a501af2dfe6d5e001) | | chromium-browser | * Upstream: | ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1273) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-1273) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2015-1273) * [Debian](https://security-tracker.debian.org/tracker/CVE-2015-1273) ### Other references * *