APP: Oracle Outside In JPEG 2000 CRG Segment Processing Heap Buffer Overflow

A heap buffer overflow vulnerability exists in Oracle Outside-In, a set of libraries used to decode many file formats. The vulnerability exists when handling the CRG marker segments in JPEG 2000 files. Oracle Outside-In is embedded in many enterprise applications. This vulnerability can be exploited by causing an application that uses the vulnerable library to handle a malformed JPEG 2000 file. Depending on the application, user interaction may be required. Successful exploitation can result in arbitrary code execution in the context of the affected application.

Extended Description

JasPer is prone to multiple remote heap-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied input. Attackers may leverage these issues to execute arbitrary code in the context of the application that uses the affected library. Failed attacks will cause denial-of-service conditions.

Affected Products

Ubuntu ubuntu_linux

References

BugTraq: 50992

CVE: CVE-2011-4517

URL: http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html

Short Name

APP:ORACLE:OUTSIDE-JPEG2-CRG

Severity

Major

Recommended

False

Recommended Action

Drop

APP: Oracle Outside In JPEG 2000 CRG Segment Processing Heap Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?