Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status

Gentoo Archives: gentoo-announce

From: Sam James <sam@g.o>
To: gentoo-announce@l.g.o
Subject: [gentoo-announce] [ GLSA 202101-29 ] OpenJPEG: Multiple vulnerabilities
Date: Tue, 26 Jan 2021 00:36:37
Message-Id: FDD1D732-62B0-4FCB-A5B9-E68FF3387FE1@gentoo.org
1 To: gentoo-announce@l.g.o
2 Subject: [ GLSA 202101-29 ] OpenJPEG: Multiple vulnerabilities
3
4 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
5 Gentoo Linux Security Advisory GLSA 202101-29
6 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
7 https://security.gentoo.org/
8 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
9
10 Severity: Normal
11 Title: OpenJPEG: Multiple vulnerabilities
12 Date: January 26, 2021
13 Bugs: #711260, #718918
14 ID: 202101-29
15
16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
17
18 Synopsis
19 ========
20
21 Multiple vulnerabilities have been found in OpenJPEG, the worst of
22 which could result in the arbitrary execution of code.
23
24 Background
25 ==========
26
27 OpenJPEG is an open-source JPEG 2000 library.
28
29 Affected packages
30 =================
31
32 -------------------------------------------------------------------
33 Package / Vulnerable / Unaffected
34 -------------------------------------------------------------------
35 1 media-libs/openjpeg < *:1 >= 2.4.0:2
36 < 2.4.0:2
37
38 Description
39 ===========
40
41 Multiple vulnerabilities have been discovered in OpenJPEG. Please
42 review the CVE identifiers referenced below for details.
43
44 Impact
45 ======
46
47 Please review the referenced CVE identifiers for details.
48
49 Workaround
50 ==========
51
52 There is no known workaround at this time.
53
54 Resolution
55 ==========
56
57 All OpenJPEG 2 users should upgrade to the latest version:
58
59 # emerge --sync
60 # emerge --ask --oneshot --verbose ">=media-libs/openjpeg-2.4.0:2"
61
62 OpenJPEG 1 has been discontinued and any dependent packages should now
63 be using OpenJPEG 2 or have dropped support for the library.
64
65 # emerge --sync
66 # emerge --ask --oneshot -v --depclean ">=media-libs/openjpeg:1"
67
68 References
69 ==========
70
71 [ 1 ] CVE-2018-21010
72 https://nvd.nist.gov/vuln/detail/CVE-2018-21010
73 [ 2 ] CVE-2019-12973
74 https://nvd.nist.gov/vuln/detail/CVE-2019-12973
75 [ 3 ] CVE-2020-15389
76 https://nvd.nist.gov/vuln/detail/CVE-2020-15389
77 [ 4 ] CVE-2020-27814
78 https://nvd.nist.gov/vuln/detail/CVE-2020-27814
79 [ 5 ] CVE-2020-27841
80 https://nvd.nist.gov/vuln/detail/CVE-2020-27841
81 [ 6 ] CVE-2020-27842
82 https://nvd.nist.gov/vuln/detail/CVE-2020-27842
83 [ 7 ] CVE-2020-27843
84 https://nvd.nist.gov/vuln/detail/CVE-2020-27843
85 [ 8 ] CVE-2020-27844
86 https://nvd.nist.gov/vuln/detail/CVE-2020-27844
87 [ 9 ] CVE-2020-27845
88 https://nvd.nist.gov/vuln/detail/CVE-2020-27845
89
90 Availability
91 ============
92
93 This GLSA and any updates to it are available for viewing at
94 the Gentoo Security Website:
95
96 https://security.gentoo.org/glsa/202101-29
97
98 Concerns?
99 =========
100
101 Security is a primary focus of Gentoo Linux and ensuring the
102 confidentiality and security of our users' machines is of utmost
103 importance to us. Any security concerns should be addressed to
104 security@g.o or alternatively, you may file a bug at
105 https://bugs.gentoo.org.
106
107 License
108 =======
109
110 Copyright 2021 Gentoo Foundation, Inc; referenced text
111 belongs to its owner(s).
112
113 The contents of this document are licensed under the
114 Creative Commons - Attribution / Share Alike license.
115
116 https://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature
Report Message
Find on MARC Find on Google Groups