NVD Vulnerability Detail

CVE-2009-5030

Summary	The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."
Publication Date	July 19, 2012, 7:55 a.m.
Registration Date	Jan. 29, 2021, 1:28 p.m.
Last Update	Nov. 21, 2024, 10:11 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://code.google.com/p/openjpeg/issues/detail?id=5
2	http://code.google.com/p/openjpeg/issues/detail?id=5
3	http://code.google.com/p/openjpeg/source/detail?r=1703	Patch
4	http://code.google.com/p/openjpeg/source/detail?r=1703	Patch
5	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html
6	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html
7	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html
8	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html
9	http://rhn.redhat.com/errata/RHSA-2012-1068.html
10	http://rhn.redhat.com/errata/RHSA-2012-1068.html
11	http://secunia.com/advisories/48781	Vendor Advisory
12	http://secunia.com/advisories/48781	Vendor Advisory
13	http://secunia.com/advisories/49913	Vendor Advisory
14	http://secunia.com/advisories/49913	Vendor Advisory
15	http://www.mandriva.com/security/advisories?name=MDVSA-2012:104
16	http://www.mandriva.com/security/advisories?name=MDVSA-2012:104
17	http://www.openwall.com/lists/oss-security/2012/04/13/5
18	http://www.openwall.com/lists/oss-security/2012/04/13/5
19	http://www.securityfocus.com/bid/53012
20	http://www.securityfocus.com/bid/53012
21	https://exchange.xforce.ibmcloud.com/vulnerabilities/74851
22	https://exchange.xforce.ibmcloud.com/vulnerabilities/74851
23	https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion
24	https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

OpenJPEG の tcd.c 内の tcd_free_encode 関数におけるサービス運用妨害 (DoS) の脆弱性

Title	OpenJPEG の tcd.c 内の tcd_free_encode 関数におけるサービス運用妨害 (DoS) の脆弱性
Summary	OpenJPEG の tcd.c 内の tcd_free_encode 関数には、サービス運用妨害 (メモリ破損) 状態となる、および任意のコードを実行される脆弱性が存在します。
Possible impacts	第三者により、割り当てメモリの不足の原因となる "invalid free (無効な解放)" を引き起こす巧妙に細工された Gray16 TIFF 画像のタイル情報を介して、サービス運用妨害 (メモリ破損) 状態にされる、および任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 29, 2012, midnight
Registration Date	July 23, 2012, 11:33 a.m.
Last Update	July 23, 2012, 11:33 a.m.

Affected System

OpenJPEG project

OpenJPEG 1.3 から 1.5

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-5030	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5030
National Vulnerability Database (NVD)
2	CVE-2009-5030	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-5030

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Fedora Update Notification
1	FEDORA-2012-9602	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html
2	FEDORA-2012-9628	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html
Google Code
3	Issue 5: Heap corruption in j2k encoder	http://code.google.com/p/openjpeg/issues/detail?id=5
4	Revision: r1703	http://code.google.com/p/openjpeg/source/detail?r=1703
Google Groups
5	[OpenJPEG] Grayscale 12/16bit issues	https://groups.google.com/forum/#!topic/openjpeg/DLVrRKbTeI0/discussion
Red Hat Security Advisory
6	RHSA-2012:1068	http://rhn.redhat.com/errata/RHSA-2012-1068.html
Security Advisories
7	MDVSA-2012:104	http://www.mandriva.com/en/support/security/advisories/?name=MDVSA-2012:104

Change Log

No	Changed Details	Date of change
0	[2012年07月23日] 掲載	Feb. 17, 2018, 10:37 a.m.