-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2012:157 http://www.mandriva.com/security/ _______________________________________________________________________ Package : openjpeg Date : October 3, 2012 Affected: 2011. _______________________________________________________________________ Problem Description: A security issue was identified and fixed in openjpeg: A heap-based buffer overflow was found in the way OpenJPEG, an open-source JPEG 2000 codec written in C language, performed parsing of JPEG2000 image files. A remote attacker could provide a specially crafted JPEG 2000 file, which when opened in an application linked against openjpeg would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application (CVE-2012-3535). The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3535 _______________________________________________________________________ Updated Packages: Mandriva Linux 2011: 19c2992e75ae2e78054fd86e4f36cbb1 2011/i586/libopenjpeg2-1.3-8.2-mdv2011.0.i586.rpm e997019eba2e7dd10bc2a1ceca6f41c5 2011/i586/libopenjpeg-devel-1.3-8.2-mdv2011.0.i586.rpm f515ecbc10f13f83d18a8c5a22c88dc3 2011/SRPMS/openjpeg-1.3-8.2.src.rpm Mandriva Linux 2011/X86_64: 7f3ede0e993d9b94712d4ef5fd7b2386 2011/x86_64/lib64openjpeg2-1.3-8.2-mdv2011.0.x86_64.rpm 704f05ff7387e4dd8425446d4459ece9 2011/x86_64/lib64openjpeg-devel-1.3-8.2-mdv2011.0.x86_64.rpm f515ecbc10f13f83d18a8c5a22c88dc3 2011/SRPMS/openjpeg-1.3-8.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iD8DBQFQa9wvmqjQ0CJFipgRAmQzAJ41BJOMi/TQLkId+nTMbSaMGYJILgCcDDqY CBRk6alBaWTvwEI1X1awg3A= =t2Hf -----END PGP SIGNATURE-----
