A memory corruption flaw exists in OpenJPEG. The tcd_free_encode() function in tcd.c fails to sanitize user-supplied input when decoding tile information from a Gray16 TIFF file resulting in memory corruption. This may allow a context-dependent attacker to execute arbitrary code.

Currently, there are no known workarounds or upgrades to correct this issue. However, a patch has been committed to the CVS/GIT repository that addresses this vulnerability. Until it is incorporated into the next release of the software, manually patching an existing installation is the only known available solution. Check the vendor advisory or solution URL in the references section.

• CVE ID: 2009-5030 (see also: NVD)
• Secunia Advisory ID: 48781 49913 52387
• Bugtraq ID: 53012
• ISS X-Force ID: 74851
• Vendor Specific Advisory URL: http://code.google.com/p/openjpeg/issues/detail?id=5
• Vendor Specific News/Changelog Entry: http://code.google.com/p/openjpeg/source/detail?r=1703
  http://www.debian.org/security/2013/dsa-2629
  https://groups.google.com/forum/#!topic/openjpeg/DLVrRKbTeI0/discussion
• Mail List Post: http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html
  http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html
• Other Advisory URL: http://www.mandriva.com/security/advisories?name=MDVSA-2012:104
  http://www.openwall.com/lists/oss-security/2012/04/13/5
• RedHat RHSA: RHSA-2012:1068

• Mathieu Malaterre