1.188.0
cf-buildpacks-eng
released this
05 Nov 16:49
·
27 commits
to main
since this release
Notably, this release addresses:
USN-7083-1 OpenJPEG vulnerabilities:
- CVE-2021-3575:
A heap-based buffer overflow was found in openjpeg in color.c:379:42 in
sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could
use this to execute arbitrary code with the permissions of the application
compiled against openjpeg. - CVE-2021-29338:
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the
application, causing a Denial of Service (DoS). This occurs when the
attacker uses the command line option "-ImgDir" on a directory that
contains 1048576 files. - CVE-2022-1122:
A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the
way it handles an input directory with a large number of files. When it
fails to allocate a buffer to store the filenames of the input directory,
it calls free() on an uninitialized pointer, leading to a segmentation
fault and a denial of service.
-ii libopenjp2-7:amd64 2.4.0-6ubuntu0.1 amd64 JPEG 2000 image compression/decompression library
-ii libopenjp2-7-dev:amd64 2.4.0-6ubuntu0.1 amd64 development files for OpenJPEG, a JPEG 2000 image library
+ii libopenjp2-7:amd64 2.4.0-6ubuntu0.2 amd64 JPEG 2000 image compression/decompression library
+ii libopenjp2-7-dev:amd64 2.4.0-6ubuntu0.2 amd64 development files for OpenJPEG, a JPEG 2000 image library```