Debian Package Tracker

general

source: openjpeg2 (main)
version: 2.3.1-1
maintainer: Debian PhotoTools Maintainers (archive) (DMD)
uploaders: Hugo Lefeuvre [DMD] – Mathieu Malaterre [DMD]
arch: all any
std-ver: 4.4.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.1.0-2+deb8u3
o-o-sec: 2.1.0-2+deb8u8
oldstable: 2.1.2-1.1+deb9u3
old-sec: 2.1.2-1.1+deb9u3
old-p-u: 2.1.2-1.1+deb9u4
stable: 2.3.0-2
testing: 2.3.1-1
unstable: 2.3.1-1

versioned links

2.1.0-2+deb8u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.1.0-2+deb8u8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.1.2-1.1+deb9u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.1.2-1.1+deb9u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libopenjp2-7
libopenjp2-7-dev (1 bugs: 0, 0, 1, 0)
libopenjp2-tools (1 bugs: 0, 0, 1, 0)
libopenjp3d-tools
libopenjp3d7
libopenjpip-dec-server
libopenjpip-server
libopenjpip-viewer
libopenjpip7

action needed

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2017-12-03 Last update: 2019-12-08 01:27

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2019-12973: In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
CVE-2019-6988: An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.

Please fix them.

Created: 2019-07-07 Last update: 2019-10-21 00:30

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2019-12973: In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
CVE-2019-6988: An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.

Please fix them.

Created: 2017-12-09 Last update: 2019-10-21 00:30

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2019-04-01 Last update: 2019-12-10 17:34

Depends on packages which need a new maintainer normal

The packages that openjpeg2 depends on which need a new maintainer are:

apache2 (#910917)
- Recommends: apache2

Created: 2019-11-22 Last update: 2019-12-10 15:39

lintian reports 8 warnings normal

Lintian reports 8 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2019-10-10 Last update: 2019-10-10 00:14

The URL(s) for this package had some recent persistent issues low

DUCK reports some issues concerning upstream URLs defined for this package.

Created: 2019-01-12 Last update: 2019-12-10 15:38

4 ignored security issues in buster low

There are 4 open security issues in buster.

4 issues skipped by the security teams:

CVE-2018-21010: OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.
CVE-2019-12973: In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
CVE-2019-6988: An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.
CVE-2018-20847: An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.

Please fix them.

Created: 2017-12-09 Last update: 2019-10-21 00:30

4 ignored security issues in jessie low

There are 4 open security issues in jessie.

4 issues skipped by the security teams:

CVE-2019-6988: An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.
CVE-2014-7947: OpenJPEG before r2944, as used in PDFium in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document, related to j2k.c, jp2.c, pi.c, t1.c, t2.c, and tcd.c.
CVE-2016-1923: Heap-based buffer overflow in the opj_j2k_update_image_data function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image.
CVE-2016-3183: The sycc422_t_rgb function in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted jpeg2000 file.

Please fix them.

Created: 2015-09-15 Last update: 2019-10-21 00:30

5 ignored security issues in stretch low

There are 5 open security issues in stretch.

5 issues skipped by the security teams:

CVE-2016-9112: Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2.
CVE-2018-21010: OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.
CVE-2019-12973: In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
CVE-2019-6988: An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress.
CVE-2018-20847: An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.

Please fix them.

Created: 2016-09-08 Last update: 2019-10-21 00:30

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2019-03-11 Last update: 2019-03-11 15:23

news

[rss feed]

[2019-10-29] Accepted openjpeg2 2.1.2-1.1+deb9u4 (source amd64 all) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Hugo Lefeuvre)
[2019-10-13] openjpeg2 2.3.1-1 MIGRATED to testing (Debian testing watch)
[2019-10-08] Accepted openjpeg2 2.1.0-2+deb8u8 (source amd64 all) into oldoldstable (Hugo Lefeuvre)
[2019-10-08] Accepted openjpeg2 2.3.1-1 (source) into unstable (Hugo Lefeuvre)
[2019-10-05] openjpeg2 2.3.0-3 MIGRATED to testing (Debian testing watch)
[2019-10-05] openjpeg2 2.3.0-3 MIGRATED to testing (Debian testing watch)
[2019-09-30] Accepted openjpeg2 2.3.0-3 (source) into unstable (Mathieu Malaterre)
[2019-07-10] Accepted openjpeg2 2.1.0-2+deb8u7 (source amd64 all) into oldoldstable (Markus Koschany)
[2019-03-15] openjpeg2 2.3.0-2 MIGRATED to testing (Debian testing watch)
[2019-03-12] Accepted openjpeg2 2.1.2-1.1+deb9u3 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Luciano Bello)
[2019-03-10] Accepted openjpeg2 2.3.0-2 (source) into unstable (Mathieu Malaterre)
[2019-03-10] Accepted openjpeg2 2.1.2-1.1+deb9u3 (source amd64 all) into stable->embargoed, stable (Luciano Bello)
[2018-12-22] Accepted openjpeg2 2.1.0-2+deb8u6 (source amd64 all) into oldstable (Hugo Lefeuvre)
[2018-12-13] openjpeg2 2.3.0-1.1 MIGRATED to testing (Debian testing watch)
[2018-12-07] Accepted openjpeg2 2.3.0-1.1 (source) into unstable (gregor herrmann)
[2018-11-19] Accepted openjpeg2 2.1.0-2+deb8u5 (source amd64 all) into oldstable (Hugo Lefeuvre)
[2018-07-19] Accepted openjpeg2 2.1.0-2+deb8u4 (source amd64 all) into oldstable (Thorsten Alteholz)
[2017-11-24] Accepted openjpeg2 2.1.0-2+deb8u3 (source amd64 all) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Mathieu Malaterre)
[2017-11-12] Accepted openjpeg2 2.1.2-1.1+deb9u2 (source) into proposed-updates->stable-new, proposed-updates (Mathieu Malaterre)
[2017-11-12] Accepted openjpeg2 2.1.2-1.1+deb9u1 (source) into proposed-updates->stable-new, proposed-updates (Mathieu Malaterre)
[2017-10-21] openjpeg2 2.3.0-1 MIGRATED to testing (Debian testing watch)
[2017-10-16] Accepted openjpeg2 2.3.0-1 (source amd64 all) into unstable (Mathieu Malaterre)
[2017-10-08] openjpeg2 2.2.0-2 MIGRATED to testing (Debian testing watch)
[2017-10-03] Accepted openjpeg2 2.2.0-2 (source) into unstable (Mathieu Malaterre)
[2017-09-29] openjpeg2 2.2.0-1 MIGRATED to testing (Debian testing watch)
[2017-09-22] Accepted openjpeg2 2.2.0-1 (source amd64 all) into unstable (Mathieu Malaterre)
[2017-08-18] openjpeg2 2.1.2-1.3 MIGRATED to testing (Debian testing watch)
[2017-08-12] Accepted openjpeg2 2.1.2-1.3 (source amd64 all) into unstable (Moritz Muehlenhoff) (signed by: Moritz Mühlenhoff)
[2017-08-12] Accepted openjpeg2 2.1.2-1.2 (source) into unstable (Moritz Muehlenhoff) (signed by: Moritz Mühlenhoff)
[2017-01-28] openjpeg2 2.1.2-1.1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 11
RC: 0
I&N: 8
M&W: 3
F&P: 0
patch: 1

links

homepage
lintian (0, 8)
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.3.1-1
2 bugs