OpenJPEG '.jpeg' File Remote Code Execution Vulnerability

Bugtraq ID:	52654
Class:	Boundary Condition Error
CVE:	CVE-2012-1499
Remote:	Yes
Local:	No
Published:	Mar 21 2012 12:00AM
Updated:	Apr 13 2015 09:42PM
Credit:	Jeong Wook Oh
Vulnerable:	OpenJPEG OpenJPEG 1.4 Gentoo Linux
Not Vulnerable:	OpenJPEG OpenJPEG 1.5

OpenJPEG '.jpeg' File Remote Code Execution Vulnerability

OpenJPEG is prone to a remote code-execution vulnerability.

Successful exploits will result in the execution of arbitrary code in the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.

OpenJPEG versions prior to 1.5 are vulnerable.

OpenJPEG '.jpeg' File Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenJPEG '.jpeg' File Remote Code Execution Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

OpenJPEG '.jpeg' File Remote Code Execution Vulnerability

References:

• libopenjpeg/jp2.c Difference (OpenJPEG)
  
• OpenJPEG Homepage (OpenJPEG)
  
• Microsoft Vulnerability Research Advisory MSVR12-004 (Microsoft)