[Secure-testing-team] Bug#874430: openjpeg2: CVE-2017-14151: heap-based buffer overflow in opj_mqc_flush

[Salvatore Bonaccorso]

Source: openjpeg2
Version: 2.1.2-1.3
Severity: grave
Tags: security upstream patch
Forwarded: https://github.com/uclouvain/openjpeg/issues/982

Hi,

the following vulnerability was published for openjpeg2.

CVE-2017-14151[0]:
| An off-by-one error was discovered in
| opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd.c in OpenJPEG
| 2.2.0. The vulnerability causes an out-of-bounds write, which may lead
| to remote denial of service (heap-based buffer overflow affecting
| opj_mqc_flush in lib/openjp2/mqc.c and opj_t1_encode_cblk in
| lib/openjp2/t1.c) or possibly remote code execution.

Verifiable with an ASAN build of openjpeg2.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-14151
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14151
[1] https://github.com/uclouvain/openjpeg/issues/982
[2] https://blogs.gentoo.org/ago/2017/08/16/openjpeg-heap-based-buffer-overflow-in-opj_mqc_flush-mqc-c/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore