CVE-2015-1239

Published: 18 October 2017

Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.

Notes

Author	Note
eslerm	j2k_read_ppm_v3 refactored with merge 28c6f54 which includes d1b053a and c887df1

Priority

Cvss 3 Severity Score

6.5

Score breakdown

Status

Package	Release	Status
openjpeg Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Not vulnerable (code not present)
	upstream	Released (2.1.1)
	xenial	Not vulnerable (code not present)
openjpeg2 Launchpad, Ubuntu, Debian	artful	Not vulnerable (2.1.1-1)
	bionic	Not vulnerable (2.3.0-1)
	focal	Not vulnerable (2.3.1-1ubuntu4)
	jammy	Not vulnerable (2.4.0-6)
	kinetic	Not vulnerable (2.5.0-1)
	trusty	Does not exist
	upstream	Released (2.1.1)
	xenial	Released (2.1.2-1.1+deb9u2build0.1)
	zesty	Not vulnerable (2.1.1-1)
	Patches: upstream: https://github.com/uclouvain/openjpeg/commit/d1b053afe2916ad65e53d2c7f4d66e5a8d1df3e7 upstream: https://github.com/uclouvain/openjpeg/commit/c887df12a38ff1a2721d0c8a93b74fe1d02701a2

Severity score breakdown

Parameter	Value
Base score	6.5
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›