[USN-4497-1] OpenJPEG vulnerabilities

[Mike Salvatore]

==========================================================================
Ubuntu Security Notice USN-4497-1
September 15, 2020

OpenJPEG vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in OpenJPEG.

Software Description:
- openjpeg2: Open-source JPEG 2000 codec written in C language

Details:

It was discovered that OpenJPEG incorrectly handled certain image files. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2016-9112)

It was discovered that OpenJPEG did not properly handle certain input. If
OpenJPEG were supplied with specially crafted input, it could be made to crash
or potentially execute arbitrary code.
(CVE-2018-20847, CVE-2018-21010, CVE-2020-6851, CVE-2020-8112, CVE-2020-15389)

It was discovered that OpenJPEG incorrectly handled certain BMP files. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2019-12973)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libopenjp2-7                    2.1.2-1.1+deb9u5build0.16.04.1
  libopenjp2-tools                2.1.2-1.1+deb9u5build0.16.04.1
  libopenjp3d-tools               2.1.2-1.1+deb9u5build0.16.04.1
  libopenjp3d7                    2.1.2-1.1+deb9u5build0.16.04.1
  libopenjpip-dec-server          2.1.2-1.1+deb9u5build0.16.04.1
  libopenjpip-server              2.1.2-1.1+deb9u5build0.16.04.1
  libopenjpip-viewer              2.1.2-1.1+deb9u5build0.16.04.1
  libopenjpip7                    2.1.2-1.1+deb9u5build0.16.04.1

In general, a standard system update will make all the necessary changes.

References:
  https://usn.ubuntu.com/4497-1
  https://launchpad.net/bugs/XXXXXX

Package Information:
  https://launchpad.net/ubuntu/+source/openjpeg2/2.1.2-1.1+deb9u5build0.16.04.1