Vulnerability-Lookup

CVE-2009-5030 (GCVE-0-2009-5030)

Vulnerability from cvelistv5 – Published: 2012-07-18 22:00 – Updated: 2024-08-07 07:24

Summary

The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

12 references

URL	Tags
http://secunia.com/advisories/48781	third-party-advisoryx_refsource_SECUNIA
http://rhn.redhat.com/errata/RHSA-2012-1068.html	vendor-advisoryx_refsource_REDHAT
https://groups.google.com/forum/#%21topic/openjpe…	x_refsource_CONFIRM
http://code.google.com/p/openjpeg/source/detail?r=1703	x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://secunia.com/advisories/49913	third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.openwall.com/lists/oss-security/2012/04/13/5	mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/53012	vdb-entryx_refsource_BID
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://code.google.com/p/openjpeg/issues/detail?id=5	x_refsource_CONFIRM

Date Public

2009-07-31 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:24:54.055Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "48781",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48781"
          },
          {
            "name": "RHSA-2012:1068",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1068.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/openjpeg/source/detail?r=1703"
          },
          {
            "name": "FEDORA-2012-9602",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html"
          },
          {
            "name": "49913",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/49913"
          },
          {
            "name": "openjpeg-tcdfreeencode-code-execution(74851)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851"
          },
          {
            "name": "MDVSA-2012:104",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104"
          },
          {
            "name": "[oss-security] 20120413 Re: CVE Request: Heap corruption in openjpeg",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/04/13/5"
          },
          {
            "name": "53012",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/53012"
          },
          {
            "name": "FEDORA-2012-9628",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/openjpeg/issues/detail?id=5"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-07-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an \"invalid free.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-16T14:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "48781",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48781"
        },
        {
          "name": "RHSA-2012:1068",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1068.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://code.google.com/p/openjpeg/source/detail?r=1703"
        },
        {
          "name": "FEDORA-2012-9602",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html"
        },
        {
          "name": "49913",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/49913"
        },
        {
          "name": "openjpeg-tcdfreeencode-code-execution(74851)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851"
        },
        {
          "name": "MDVSA-2012:104",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104"
        },
        {
          "name": "[oss-security] 20120413 Re: CVE Request: Heap corruption in openjpeg",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/04/13/5"
        },
        {
          "name": "53012",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/53012"
        },
        {
          "name": "FEDORA-2012-9628",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://code.google.com/p/openjpeg/issues/detail?id=5"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-5030",
    "datePublished": "2012-07-18T22:00:00.000Z",
    "dateReserved": "2010-12-09T00:00:00.000Z",
    "dateUpdated": "2024-08-07T07:24:54.055Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2009-5030",
      "date": "2026-09-23",
      "epss": "0.04063",
      "percentile": "0.90224"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:uclouvain:openjpeg:1.3:*:*:*:*:*:*:*",
                  "matchCriteriaId": "7AC444C0-9F0C-4CA5-B07B-4CFD40083232",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:uclouvain:openjpeg:1.4:*:*:*:*:*:*:*",
                  "matchCriteriaId": "BD7783C8-538F-4D5C-8F73-658805E9315A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:uclouvain:openjpeg:1.5:*:*:*:*:*:*:*",
                  "matchCriteriaId": "564678E7-4F36-48CE-A971-3639802E3428",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an \"invalid free.\""
        },
        {
          "lang": "es",
          "value": "La funci\u00f3n tcd_free_encode tcd.c en OpenJPEG v1.3 a v1.5 permite a atacantes remotos causar una denegaci\u00f3n de servicio (corrupci\u00f3n de memoria) y posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de la informaci\u00f3n de mosaico modificada en una imagen Gray16 TIFF, lo que hace que no se reserve la memoria suficiente y conduce a un \"invalid free\"."
        }
      ],
      "id": "CVE-2009-5030",
      "lastModified": "2024-11-21T01:11:01.493",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "MEDIUM",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 6.8,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 8.6,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": true
          }
        ]
      },
      "published": "2012-07-18T22:55:03.680",
      "references": [
        {
          "source": "secalert@redhat.com",
          "url": "http://code.google.com/p/openjpeg/issues/detail?id=5"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Patch"
          ],
          "url": "http://code.google.com/p/openjpeg/source/detail?r=1703"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1068.html"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://secunia.com/advisories/48781"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://secunia.com/advisories/49913"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://www.openwall.com/lists/oss-security/2012/04/13/5"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://www.securityfocus.com/bid/53012"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://code.google.com/p/openjpeg/issues/detail?id=5"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "http://code.google.com/p/openjpeg/source/detail?r=1703"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1068.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://secunia.com/advisories/48781"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://secunia.com/advisories/49913"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.openwall.com/lists/oss-security/2012/04/13/5"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.securityfocus.com/bid/53012"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion"
        }
      ],
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-119"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:uclouvain:openjpeg:1.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7AC444C0-9F0C-4CA5-B07B-4CFD40083232",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:uclouvain:openjpeg:1.4:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BD7783C8-538F-4D5C-8F73-658805E9315A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:uclouvain:openjpeg:1.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "564678E7-4F36-48CE-A971-3639802E3428",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an \"invalid free.\""
          },
          {
            "lang": "es",
            "value": "La funci\u00f3n tcd_free_encode tcd.c en OpenJPEG v1.3 a v1.5 permite a atacantes remotos causar una denegaci\u00f3n de servicio (corrupci\u00f3n de memoria) y posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de la informaci\u00f3n de mosaico modificada en una imagen Gray16 TIFF, lo que hace que no se reserve la memoria suficiente y conduce a un \"invalid free\"."
          }
        ],
        "id": "CVE-2009-5030",
        "lastModified": "2026-04-29T01:13:23.040",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.8,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ]
        },
        "published": "2012-07-18T22:55:03.680",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "http://code.google.com/p/openjpeg/issues/detail?id=5"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Patch"
            ],
            "url": "http://code.google.com/p/openjpeg/source/detail?r=1703"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1068.html"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/48781"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/49913"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.openwall.com/lists/oss-security/2012/04/13/5"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.securityfocus.com/bid/53012"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://code.google.com/p/openjpeg/issues/detail?id=5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "http://code.google.com/p/openjpeg/source/detail?r=1703"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1068.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/48781"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/49913"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openwall.com/lists/oss-security/2012/04/13/5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/53012"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-119"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2025-11-21T12:51:54+00:00",
      "cve": "CVE-2009-5030",
      "id": "CVE-2009-5030",
      "initial_release_date": "2009-07-31T00:00:00+00:00",
      "product_status:fixed": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "openjpeg: Heap memory corruption leading to invalid free by processing certain Gray16 TIFF images",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2009/cve-2009-5030.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2025-10-08T01:33:35Z",
      "cve": "CVE-2009-5030",
      "id": "CVE-2009-5030",
      "initial_release_date": "2023-02-15T06:01:13Z",
      "product_status:recommended": "71",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2009-5030",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2009-5030.json",
      "version": "7"
    }
  }
}

BDU:2015-09686 (CVE-2009-5030)

Vulnerability from fstec – Published: 2015-04-28 – Updated: 2026-04-30 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимости операционной системы Gentoo Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Summary

Множественные уязвимости пакета openjpeg (до версии 1.5.1) операционной системы Gentoo Linux, эксплуатация которых может привести к нарушению конфиденциальности, целостности и доступности защищаемой информации. Эксплуатация уязвимостей может быть осуществлена удаленно

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-119 - Выход операции за границы буфера в памяти

Aliases

CVE-2009-5030, CVE-2012-3358, CVE-2012-3535, GLSA-201310-07

References

2 references

URL
http://security.gentoo.org/glsa/glsa-201310-07.xml
http://code.google.com/p/openjpeg/issues/detail?id=170

Impacted products

1 product from 1 vendor

Vendors

Gentoo Foundation Inc.

Products

Gentoo Linux

Versions

до 20140826 (Gentoo Linux)

Product types

Operating system

Mitigations

Обновление пакета openjpeg до версии 1.5.1 или выше

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Gentoo Foundation Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 20140826 (Gentoo Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 openjpeg \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.5.1 \u0438\u043b\u0438 \u0432\u044b\u0448\u0435",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "10.10.2013",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "30.04.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.04.2015",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2015-09686",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2009-5030, CVE-2012-3358, CVE-2012-3535, GLSA-201310-07",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Gentoo Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Gentoo Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0412\u044b\u0445\u043e\u0434 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 (CWE-119)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 openjpeg (\u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 1.5.1) \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Gentoo Linux, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://security.gentoo.org/glsa/glsa-201310-07.xml\nhttp://code.google.com/p/openjpeg/issues/detail?id=170",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-119",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)"
}

FKIE_CVE-2009-5030

Vulnerability from fkie_nvd - Published: 2012-07-18 22:55 - Updated: 2026-06-16 23:14

Severity

Summary

References

URL	Tags
secalert@redhat.com	http://code.google.com/p/openjpeg/issues/detail?id=5
secalert@redhat.com	http://code.google.com/p/openjpeg/source/detail?r=1703	Patch
secalert@redhat.com	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html
secalert@redhat.com	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html
secalert@redhat.com	http://rhn.redhat.com/errata/RHSA-2012-1068.html
secalert@redhat.com	http://secunia.com/advisories/48781	Vendor Advisory
secalert@redhat.com	http://secunia.com/advisories/49913	Vendor Advisory
secalert@redhat.com	http://www.mandriva.com/security/advisories?name=MDVSA-2012:104
secalert@redhat.com	http://www.openwall.com/lists/oss-security/2012/04/13/5
secalert@redhat.com	http://www.securityfocus.com/bid/53012
secalert@redhat.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/74851
secalert@redhat.com	https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion
af854a3a-2127-422b-91ae-364da2661108	http://code.google.com/p/openjpeg/issues/detail?id=5
af854a3a-2127-422b-91ae-364da2661108	http://code.google.com/p/openjpeg/source/detail?r=1703	Patch
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2012-1068.html
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/48781	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/49913	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.mandriva.com/security/advisories?name=MDVSA-2012:104
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2012/04/13/5
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/53012
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/74851
af854a3a-2127-422b-91ae-364da2661108	https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion

Impacted products

Vendor	Product	Version
uclouvain	openjpeg	1.3
uclouvain	openjpeg	1.4
uclouvain	openjpeg	1.5

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:uclouvain:openjpeg:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7AC444C0-9F0C-4CA5-B07B-4CFD40083232",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:uclouvain:openjpeg:1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD7783C8-538F-4D5C-8F73-658805E9315A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:uclouvain:openjpeg:1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "564678E7-4F36-48CE-A971-3639802E3428",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an \"invalid free.\""
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n tcd_free_encode tcd.c en OpenJPEG v1.3 a v1.5 permite a atacantes remotos causar una denegaci\u00f3n de servicio (corrupci\u00f3n de memoria) y posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de la informaci\u00f3n de mosaico modificada en una imagen Gray16 TIFF, lo que hace que no se reserve la memoria suficiente y conduce a un \"invalid free\"."
    }
  ],
  "id": "CVE-2009-5030",
  "lastModified": "2026-06-16T23:14:51.677",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2012-07-18T22:55:03.680",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://code.google.com/p/openjpeg/issues/detail?id=5"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://code.google.com/p/openjpeg/source/detail?r=1703"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1068.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/48781"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/49913"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2012/04/13/5"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/53012"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://code.google.com/p/openjpeg/issues/detail?id=5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://code.google.com/p/openjpeg/source/detail?r=1703"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1068.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/48781"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/49913"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2012/04/13/5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/53012"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-5F2V-78X3-PVGJ

Vulnerability from github – Published: 2022-05-02 04:00 – Updated: 2022-05-02 04:00

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2009-5030"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-07-18T22:55:00Z",
    "severity": "MODERATE"
  },
  "details": "The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an \"invalid free.\"",
  "id": "GHSA-5f2v-78x3-pvgj",
  "modified": "2022-05-02T04:00:44Z",
  "published": "2022-05-02T04:00:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-5030"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/forum/#!topic/openjpeg/DLVrRKbTeI0/discussion"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion"
    },
    {
      "type": "WEB",
      "url": "http://code.google.com/p/openjpeg/issues/detail?id=5"
    },
    {
      "type": "WEB",
      "url": "http://code.google.com/p/openjpeg/source/detail?r=1703"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2012-1068.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/48781"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/49913"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2012/04/13/5"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/53012"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2009-5030

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2009-5030

Aliases

CVE-2009-5030

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2009-5030",
    "description": "The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an \"invalid free.\"",
    "id": "GSD-2009-5030",
    "references": [
      "https://www.suse.com/security/cve/CVE-2009-5030.html",
      "https://www.debian.org/security/2013/dsa-2629",
      "https://access.redhat.com/errata/RHSA-2012:1068",
      "https://alas.aws.amazon.com/cve/html/CVE-2009-5030.html",
      "https://linux.oracle.com/cve/CVE-2009-5030.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2009-5030"
      ],
      "details": "The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an \"invalid free.\"",
      "id": "GSD-2009-5030",
      "modified": "2023-12-13T01:19:48.758667Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2009-5030",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an \"invalid free.\""
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "http://code.google.com/p/openjpeg/issues/detail?id=5",
            "refsource": "MISC",
            "url": "http://code.google.com/p/openjpeg/issues/detail?id=5"
          },
          {
            "name": "http://code.google.com/p/openjpeg/source/detail?r=1703",
            "refsource": "MISC",
            "url": "http://code.google.com/p/openjpeg/source/detail?r=1703"
          },
          {
            "name": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html",
            "refsource": "MISC",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html"
          },
          {
            "name": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html",
            "refsource": "MISC",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html"
          },
          {
            "name": "http://rhn.redhat.com/errata/RHSA-2012-1068.html",
            "refsource": "MISC",
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1068.html"
          },
          {
            "name": "http://secunia.com/advisories/48781",
            "refsource": "MISC",
            "url": "http://secunia.com/advisories/48781"
          },
          {
            "name": "http://secunia.com/advisories/49913",
            "refsource": "MISC",
            "url": "http://secunia.com/advisories/49913"
          },
          {
            "name": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104",
            "refsource": "MISC",
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104"
          },
          {
            "name": "http://www.openwall.com/lists/oss-security/2012/04/13/5",
            "refsource": "MISC",
            "url": "http://www.openwall.com/lists/oss-security/2012/04/13/5"
          },
          {
            "name": "http://www.securityfocus.com/bid/53012",
            "refsource": "MISC",
            "url": "http://www.securityfocus.com/bid/53012"
          },
          {
            "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851",
            "refsource": "MISC",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851"
          },
          {
            "name": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion",
            "refsource": "MISC",
            "url": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:uclouvain:openjpeg:1.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:uclouvain:openjpeg:1.4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:uclouvain:openjpeg:1.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2009-5030"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an \"invalid free.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-119"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "FEDORA-2012-9602",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/083105.html"
            },
            {
              "name": "53012",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/53012"
            },
            {
              "name": "http://code.google.com/p/openjpeg/issues/detail?id=5",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://code.google.com/p/openjpeg/issues/detail?id=5"
            },
            {
              "name": "RHSA-2012:1068",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2012-1068.html"
            },
            {
              "name": "FEDORA-2012-9628",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082923.html"
            },
            {
              "name": "48781",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/48781"
            },
            {
              "name": "[oss-security] 20120413 Re: CVE Request: Heap corruption in openjpeg",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2012/04/13/5"
            },
            {
              "name": "http://code.google.com/p/openjpeg/source/detail?r=1703",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "http://code.google.com/p/openjpeg/source/detail?r=1703"
            },
            {
              "name": "MDVSA-2012:104",
              "refsource": "MANDRIVA",
              "tags": [],
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:104"
            },
            {
              "name": "49913",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/49913"
            },
            {
              "name": "openjpeg-tcdfreeencode-code-execution(74851)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74851"
            },
            {
              "name": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion",
              "refsource": "MISC",
              "tags": [],
              "url": "https://groups.google.com/forum/#%21topic/openjpeg/DLVrRKbTeI0/discussion"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2023-02-13T02:20Z",
      "publishedDate": "2012-07-18T22:55Z"
    }
  }
}

OPENSUSE-SU-2024:10227-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 19:54

Summary

libopenjpeg1-1.5.2-4.7 on GA media

Severity

Moderate

Scope

11 vulnerabilities in this advisory, including CVE-2009-5030.

CVE-2009-5030

Recommended: 20 products

Open the full advisory

RHSA-2012:1068

Vulnerability from csaf_redhat - Published: 2012-07-11 16:39 - Updated: 2026-06-25 10:38

Summary

Red Hat Security Advisory: openjpeg security update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2009-5030.

CVE-2009-5030

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

Fixed: 65 products

https://access.redhat.com/errata/RHSA-2012:1068

Open the full advisory

RHSA-2012_1068

Vulnerability from csaf_redhat - Published: 2012-07-11 16:39 - Updated: 2024-11-22 05:26

Summary

Red Hat Security Advisory: openjpeg security update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2009-5030.

CVE-2009-5030

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

Fixed: 184 products

https://access.redhat.com/errata/RHSA-2012:1068

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2009-5030 (GCVE-0-2009-5030)

BDU:2015-09686 (CVE-2009-5030)

FKIE_CVE-2009-5030

GHSA-5F2V-78X3-PVGJ

GSD-2009-5030

OPENSUSE-SU-2024:10227-1

RHSA-2012:1068

RHSA-2012_1068

Tags

Sightings

Nomenclature

Related by attack behaviour