Description
The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | openjpeg | 1.3+dfsg-4+squeeze1 | DSA-2629-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | openjpeg +2 | 1.3-8.el6_3 | RHSA-2012:1068 |
Advisories 2
- RHSA-2012:1068 Red Hat Security Advisory: openjpeg security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2629-1 openjpeg - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- 48781 third-party-advisory
- RHSA-2012:1068 vendor-advisory
- https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion
- http://code.google.com/p/openjpeg/source/detail?r=1703
- FEDORA-2012-9602 vendor-advisory
- 49913 third-party-advisory
- openjpeg-tcdfreeencode-code-execution(74851) vdb-entry
- MDVSA-2012:104 vendor-advisory
- [oss-security] 20120413 Re: CVE Request: Heap corruption in openjpeg mailing-list
- 53012 vdb-entry
- FEDORA-2012-9628 vendor-advisory
- http://code.google.com/p/openjpeg/issues/detail?id=5