openjpeg2 - Debian Package Tracker

general

source: openjpeg2 (main)
version: 2.5.0-2
maintainer: Debian PhotoTools Maintainers (archive) (DMD)
uploaders: Mathieu Malaterre [DMD] – Hugo Lefeuvre [DMD]
arch: all any
std-ver: 4.6.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.3.0-2+deb10u2
o-o-sec: 2.3.0-2+deb10u2
oldstable: 2.4.0-3
stable: 2.5.0-2
testing: 2.5.0-2
unstable: 2.5.0-2

versioned links

2.3.0-2+deb10u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.5.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libopenjp2-7
libopenjp2-7-dev
libopenjp2-tools (1 bugs: 0, 0, 1, 0)
libopenjpip-dec-server
libopenjpip-server
libopenjpip-viewer
libopenjpip7
openjpeg-doc

action needed

A new upstream version is available: 2.5.3 high

A new upstream version 2.5.3 is available, you should consider packaging it.

Created: 2024-03-01 Last update: 2025-01-12 10:00

7 security issues in trixie high

There are 7 open security issues in trixie.

7 important issues:

CVE-2019-6988: An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.
CVE-2021-3575: A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.
CVE-2023-39327: A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.
CVE-2023-39328: A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.
CVE-2023-39329: A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service.
CVE-2024-56826: A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.
CVE-2024-56827: A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.

Created: 2023-06-11 Last update: 2025-01-10 17:30

7 security issues in sid high

There are 7 open security issues in sid.

7 important issues:

CVE-2019-6988: An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.
CVE-2021-3575: A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.
CVE-2023-39327: A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.
CVE-2023-39328: A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.
CVE-2023-39329: A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service.
CVE-2024-56826: A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.
CVE-2024-56827: A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.

Created: 2022-07-04 Last update: 2025-01-10 17:30

9 security issues in bullseye high

There are 9 open security issues in bullseye.

2 important issues:

CVE-2024-56826: A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.
CVE-2024-56827: A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.

6 issues postponed or untriaged:

CVE-2021-3575: (needs triaging) A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.
CVE-2022-1122: (needs triaging) A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service.
CVE-2021-29338: (needs triaging) Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
CVE-2023-39327: (needs triaging) A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.
CVE-2023-39328: (needs triaging) A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.
CVE-2023-39329: (needs triaging) A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service.

1 ignored issue:

CVE-2019-6988: An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.

Created: 2025-01-02 Last update: 2025-01-10 17:30

7 security issues in bookworm high

There are 7 open security issues in bookworm.

2 important issues:

CVE-2024-56826: A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.
CVE-2024-56827: A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.

4 issues left for the package maintainer to handle:

CVE-2021-3575: (needs triaging) A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.
CVE-2023-39327: (postponed; to be fixed through a stable update) A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.
CVE-2023-39328: (postponed; to be fixed through a stable update) A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.
CVE-2023-39329: (postponed; to be fixed through a stable update) A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, causing a denial of service.

You can find information about how to handle these issues in the security team's documentation.

1 ignored issue:

CVE-2019-6988: An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.

Created: 2023-06-10 Last update: 2025-01-10 17:30

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2025-01-06 Last update: 2025-01-12 10:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.5.3-1, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 97632441ab3ccf3a012dd55a0ca706169a0094aa
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 21:15:48 2024 +0100

    Add TODO

commit a2012a6731b4789ade0b704b6d607fc64d8a6e45
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 21:15:30 2024 +0100

    Fix installation

commit ab7cc10e8ede31d5af90fec7ed58786ba9cbe560
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 20:04:35 2024 +0100

    Close bug

commit 42f3f22829d1b0872b4895556cb3844b618b34a9
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 20:03:54 2024 +0100

    Solve openjpeg / apache build-dep loop

commit dd9a51feff02c6516e3e3b31114f581d32b21fab
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 20:00:27 2024 +0100

    Refresh patch

commit 83ca4af406eb3b531227de973c58ee35013726c7
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 19:57:14 2024 +0100

    watch file standard 4 (routine-update)

commit 711de0a8ac7ef489b924ba16215b5f1e15224ef0
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 19:57:02 2024 +0100

    Rules-Requires-Root: no (routine-update)

commit dc4eafd445d8a81377ef54845d0df72b6ed2e3c4
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 19:57:02 2024 +0100

    Do not parse d/changelog (routine-update)

commit addc7528f37a89099fcb4c55f208f404151838df
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 19:56:58 2024 +0100

    d/rules: Do not parse d/changelog

commit 87ca35b5bafcbc62099dce77bf21ea38bd5c6d53
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 19:53:26 2024 +0100

    debhelper-compat 13 (routine-update)

commit 2e8f187c1beb69cc193cd2a21ba01d93321f8c87
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 19:53:26 2024 +0100

    Standards-Version: 4.7.0 (routine-update)

commit 61fbf421267316c8f051058bcf3ca84aeefc0ce3
Merge: bf47632 12a53cf
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 19:53:25 2024 +0100

    Update upstream source from tag 'upstream/2.5.3'
    
    Update to upstream version '2.5.3'
    with Debian dir 073a6907ae3e3b92ccc947d00a948b5077ee1ee8

commit bf47632b91a7cb5f984da2c7f90f733215088bf7
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 19:53:23 2024 +0100

    New upstream version

commit 12a53cfd95d297294cbb7ecb0d22d64ca2a8227e
Author: Andreas Tille <tille@debian.org>
Date:   Sat Dec 14 19:53:23 2024 +0100

    New upstream version 2.5.3

commit d3f6cdbf1006e5c7c75c583e15b52118ffb3abaf
Author: Bastian Germann <bage@debian.org>
Date:   Tue Sep 19 20:48:07 2023 +0200

    Remove retired Uploader (Closes: #1050257)

Created: 2023-09-19 Last update: 2025-01-08 23:23

lintian reports 81 warnings normal

Lintian reports 81 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2023-05-27 Last update: 2023-05-27 06:08

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2024-10-29 Last update: 2024-10-29 14:30

debian/patches: 1 patch to forward upstream low

Among the 2 debian patches available in version 2.5.0-2 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2023-05-27 09:13

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.0 instead of 4.6.1).

Created: 2022-12-17 Last update: 2024-04-07 13:14

news

[rss feed]

[2023-06-02] openjpeg2 2.5.0-2 MIGRATED to testing (Debian testing watch)
[2023-05-26] Accepted openjpeg2 2.5.0-2 (source) into unstable (Andreas Metzler)
[2022-06-26] openjpeg2 2.5.0-1 MIGRATED to testing (Debian testing watch)
[2022-06-20] Accepted openjpeg2 2.5.0-1 (source) into unstable (Mathieu Malaterre)
[2022-04-10] Accepted openjpeg2 2.1.2-1.1+deb9u7 (source) into oldoldstable (Anton Gladky)
[2022-01-22] openjpeg2 2.4.0-6 MIGRATED to testing (Debian testing watch)
[2022-01-17] Accepted openjpeg2 2.4.0-6 (source) into unstable (Mathieu Malaterre)
[2022-01-14] Accepted openjpeg2 2.4.0-5 (source) into unstable (Mathieu Malaterre)
[2022-01-14] Accepted openjpeg2 2.4.0-4 (source amd64 all) into unstable, unstable (Debian FTP Masters) (signed by: Mathieu Malaterre)
[2021-04-05] Accepted openjpeg2 2.3.0-2+deb10u2 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2021-04-01] Accepted openjpeg2 2.3.0-2+deb10u2 (source amd64 all) into stable->embargoed, stable (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2021-02-20] openjpeg2 2.4.0-3 MIGRATED to testing (Debian testing watch)
[2021-02-09] Accepted openjpeg2 2.4.0-3 (source) into unstable (Mathieu Malaterre)
[2021-02-08] Accepted openjpeg2 2.1.2-1.1+deb9u6 (source amd64 all) into oldstable (Brian May)
[2021-02-08] Accepted openjpeg2 2.4.0-2 (source) into unstable (Mathieu Malaterre)
[2021-02-02] openjpeg2 2.4.0-1 MIGRATED to testing (Debian testing watch)
[2021-01-27] Accepted openjpeg2 2.4.0-1 (source) into unstable (Mathieu Malaterre)
[2020-07-10] Accepted openjpeg2 2.1.2-1.1+deb9u5 (source amd64 all) into oldstable (Utkarsh Gupta)
[2020-01-30] Accepted openjpeg2 2.1.0-2+deb8u10 (source amd64 all) into oldoldstable (Mike Gabriel)
[2020-01-28] Accepted openjpeg2 2.1.0-2+deb8u9 (source amd64 all) into oldoldstable (Mike Gabriel)
[2019-12-29] Accepted openjpeg2 2.3.0-2+deb10u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Hugo Lefeuvre)
[2019-10-29] Accepted openjpeg2 2.1.2-1.1+deb9u4 (source amd64 all) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Hugo Lefeuvre)
[2019-10-13] openjpeg2 2.3.1-1 MIGRATED to testing (Debian testing watch)
[2019-10-08] Accepted openjpeg2 2.1.0-2+deb8u8 (source amd64 all) into oldoldstable (Hugo Lefeuvre)
[2019-10-08] Accepted openjpeg2 2.3.1-1 (source) into unstable (Hugo Lefeuvre)
[2019-10-05] openjpeg2 2.3.0-3 MIGRATED to testing (Debian testing watch)
[2019-09-30] Accepted openjpeg2 2.3.0-3 (source) into unstable (Mathieu Malaterre)
[2019-07-10] Accepted openjpeg2 2.1.0-2+deb8u7 (source amd64 all) into oldoldstable (Markus Koschany)
[2019-03-15] openjpeg2 2.3.0-2 MIGRATED to testing (Debian testing watch)
[2019-03-12] Accepted openjpeg2 2.1.2-1.1+deb9u3 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Luciano Bello)

bugs [bug history graph]

all: 13
RC: 0
I&N: 11
M&W: 2
F&P: 0
patch: 2

links

homepage
lintian (0, 81)
buildd: logs, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.5.0-2ubuntu2
3 bugs (1 patch)
patches for 2.5.0-2ubuntu2