SB2015101401 - Input validation error in openjpeg (Alpine package)
Published: October 14, 2015
Security Bulletin ID
SB2015101401
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2015-6581)
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 45.0.2454.85, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering a memory-allocation failure. <a href="http://cwe.mitre.org/data/definitions/415.html">CWE-415: Double Free</a>
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=75fc21729969f5ee39b47bd07b3c76b9c4d08d6d
- https://git.alpinelinux.org/aports/commit/?id=d69f651532084cd3842feaf6042650f72ab30ee4
- https://git.alpinelinux.org/aports/commit/?id=761b7d001874b2e252d974a0b0c1d5e445dd1680
- https://git.alpinelinux.org/aports/commit/?id=35be8d73cef9bc2ec4f44f22bbb99d6f84312c9c