openjpeg security update

CentOS Errata and Security Advisory CESA-2017:0838

OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.

Security Fix(es):

• Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potentially, execute arbitrary code. (CVE-2016-5139, CVE-2016-5158, CVE-2016-5159, CVE-2016-7163)

• An out-of-bounds read vulnerability was found in OpenJPEG, in the j2k_to_image tool. Converting a specially crafted JPEG2000 file to another format could cause the application to crash or, potentially, disclose some data from the heap. (CVE-2016-9573)

• A heap-based buffer overflow vulnerability was found in OpenJPEG. A specially crafted JPEG2000 image, when read by an application using OpenJPEG, could cause the application to crash or, potentially, execute arbitrary code. (CVE-2016-9675)

Red Hat would like to thank Liu Bingchang (IIE) for reporting CVE-2016-9573. The CVE-2016-9675 issue was discovered by Doran Moppert (Red Hat Product Security).

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2017-March/084511.html

Affected packages:
openjpeg
openjpeg-devel
openjpeg-libs

Upstream details at:
https://access.redhat.com/errata/RHSA-2017:0838