A heap-based buffer overflow was found in the way OpenJPEG, an open-source JPEG 2000 codec written in C language, performed parsing of JPEG2000 having certain number of tiles and tilesizes. A remote attacker could provide a specially crafted JPEG 2000 file, which when opened in an application linked against openjpeg would lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.
Created attachment 594684 [details] openjpeg-tile-sanity.patch Um, this is the relevant patch, not that one.
This is now public: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=681075
Here is the upstream commit: http://code.google.com/p/openjpeg/source/detail?r=1727
Created openjpeg tracking bugs for this issue Affects: fedora-all [bug 839125]
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2012:1068 https://rhn.redhat.com/errata/RHSA-2012-1068.html