USN-5952-1: OpenJPEG vulnerabilities
15 March 2023
Several security issues were fixed in OpenJPEG.
Releases
Packages
- openjpeg2 - JPEG 2000 image compression/decompression library
Details
Sebastian Poeplau discovered that OpenJPEG incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu 18.04
LTS. (CVE-2020-6851, CVE-2020-8112)
It was discovered that OpenJPEG incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2020-15389, CVE-2020-27814, CVE-2020-27823, CVE-2020-27824,
CVE-2020-27841, CVE-2020-27845)
It was discovered that OpenJPEG incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2020-27842, CVE-2020-27843)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04
-
libopenjp3d7
-
2.3.0-2+deb10u2build0.18.04.1
-
libopenjpip7
-
2.3.0-2+deb10u2build0.18.04.1
-
libopenjp2-7
-
2.3.0-2+deb10u2build0.18.04.1
Ubuntu 16.04
-
libopenjp3d7
-
2.1.2-1.1+deb9u6ubuntu0.1~esm3
Available with Ubuntu Pro
-
libopenjpip7
-
2.1.2-1.1+deb9u6ubuntu0.1~esm3
Available with Ubuntu Pro
-
libopenjp2-7
-
2.1.2-1.1+deb9u6ubuntu0.1~esm3
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.