Description
Multiple heap-based buffer overflows in OpenJPEG 1.3 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | openjpeg | 1.3+dfsg-4.7 | DSA-2808-1 |
| Debian 6.0 | openjpeg | 1.3+dfsg-4+squeeze2 | DSA-2808-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | openjpeg +2 | 1.3-10.el6_5 | RHSA-2013:1850 |
Advisories 2
- RHSA-2013:1850 Red Hat Security Advisory: openjpeg security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2808-1 openjpeg - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 64109 vdb-entry
- RHSA-2013:1850 vendor-advisory
- 100638 vdb-entry
- 100637 vdb-entry
- 100636 vdb-entry
- 100646 vdb-entry
- http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS
- 100641 vdb-entry
- [oss-security] 20131204 Fwd: [vs] multiple issues in openjpeg mailing-list
- DSA-2808 vendor-advisory