Bug 33905 - openjpeg2 new security issues CVE-2024-5682[67]
Summary: openjpeg2 new security issues CVE-2024-5682[67]
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-01-10 08:53 CET by Nicolas Salguero
Modified: 2025-01-16 08:15 CET (History)
4 users (show)

See Also:
Source RPM: openjpeg2-2.5.0-1.1.mga9.src.rpm
CVE: CVE-2024-56826, CVE-2024-56827
Status comment:


Attachments

Nicolas Salguero 2025-01-10 08:53:57 CET

Status comment: (none) => Fixed upstream in 2.5.3 and patches available from upstream
Source RPM: (none) => openjpeg2-2.5.0-1.1.mga9.src.rpm
CVE: (none) => CVE-2024-56826, CVE-2024-56827

Comment 1 Morgan Leijström 2025-01-10 09:16:53 CET
I see you Nicolas last touched it.
Assigning to you, if you do not want to take it please assign all packagers.

CC: (none) => fri
Assignee: bugsquad => nicolas.salguero

Comment 2 Nicolas Salguero 2025-01-10 09:19:58 CET
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

Heap buffer overflow in bin/common/color.c. (CVE-2024-56826)

Heap buffer overflow in lib/openjp2/j2k.c. (CVE-2024-56827)

References:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AWMGURRKWFOTMCKEBHYWF7HHDJSY7BTR/
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/XKBM37J7PMJ763EKO4IP3FLOLF4U26HW/
========================

Updated packages in core/updates_testing:
========================
lib(64)openjp2_7-2.5.0-1.2.mga9
lib(64)openjpeg2-devel-2.5.0-1.2.mga9
openjpeg2-2.5.0-1.2.mga9

from SRPM:
openjpeg2-2.5.0-1.2.mga9.src.rpm

Assignee: nicolas.salguero => qa-bugs
Status: NEW => ASSIGNED
Summary: openjpeg2 new security issues, including CVE-2024-5682[67] => openjpeg2 new security issues CVE-2024-5682[67]
Status comment: Fixed upstream in 2.5.3 and patches available from upstream => (none)

katnatek 2025-01-10 19:35:07 CET

Keywords: (none) => advisory

Comment 3 katnatek 2025-01-11 17:53:10 CET
RH x86_64

installing lib64openjp2_7-2.5.0-1.2.mga9.x86_64.rpm openjpeg2-2.5.0-1.2.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/2: lib64openjp2_7        ##################################################################################################
      2/2: openjpeg2             ##################################################################################################
      1/2: removing openjpeg2-2.5.0-1.1.mga9.x86_64
                                 ##################################################################################################
      2/2: removing lib64openjp2_7-2.5.0-1.1.mga9.x86_64
                                 ##################################################################################################


The output of the poc command with the test file is similar before and after update and looks like this other bug where you have to recompile to reproduce

strace chromium-browser contain
openat(AT_FDCWD, "/lib64/libopenjp2.so.7", O_RDONLY|O_CLOEXEC) = 3
Comment 4 Brian Rockwell 2025-01-13 01:27:52 CET
installed

Ran utilities against sample file

$ opj_decompress -i sample1.jp2 -o sample1.bmp

able to view output file

$ opj_compress -i sample1.bmp -o smp.jp2

compression worked - I don't have a viewer

$ opj_dump -i sample1.jp

dumped

CC: (none) => brtians1
Whiteboard: (none) => MGA9-64-OK

Comment 5 Thomas Andrews 2025-01-14 18:21:29 CET
Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Comment 6 Mageia Robot 2025-01-16 08:15:29 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0012.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.