CVE-2015-6581

Published: 03 September 2015

Double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 45.0.2454.85, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering a memory-allocation failure.

Priority

Medium

Status

Package Release Status
chromium-browser
Launchpad, Ubuntu, Debian 		Upstream
Released (45.0.2454.85)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (45.0.2454.85-0ubuntu1.1198)
Ubuntu 16.04 LTS (Xenial Xerus)
Released (45.0.2454.85-0ubuntu1.1198)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was released [45.0.2454.85-0ubuntu0.14.04.1.1097])
openjpeg
Launchpad, Ubuntu, Debian 		Upstream Not vulnerable
(code not present)
Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 LTS (Xenial Xerus) Not vulnerable
(code not present)
Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable
(code not present)
Patches:
Upstream: https://code.google.com/p/openjpeg/source/detail?r=3002
Upstream: https://github.com/uclouvain/openjpeg/commit/1fb24aba4b29b7cd1b6880d8f0b08196a12efc2c
oxide-qt
Launchpad, Ubuntu, Debian 		Upstream Not vulnerable

Ubuntu 18.04 LTS (Bionic Beaver) Does not exist

Ubuntu 16.04 LTS (Xenial Xerus) Not vulnerable

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was not-affected)

References

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM

Further reading