CVE-2016-5139 Amazon Linux Security Advisory for openjpeg: ALAS-2017-807

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in OpenJPEG. A specially crafted JPEG2000 image could cause an application using OpenJPEG to crash or, potentially, execute arbitrary code. (CVE-2016-5139 , CVE-2016-5158 , CVE-2016-5159 , CVE-2016-7163 )

A vulnerability was found in the patch for CVE-2013-6045 for OpenJPEG. A specially crafted JPEG2000 image, when read by an application using OpenJPEG, could cause heap-based buffer overflows leading to a crash or, potentially, arbitrary code execution. (CVE-2016-9675 )

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2017-807 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2017-807: Amazon Linux (openjpeg (1.3-16.9.amzn1) on i686)

ALAS-2017-807: Amazon Linux (openjpeg (1.3-16.9.amzn1) on x86_64)

ALAS-2017-807: Amazon Linux (openjpeg (1.3-16.9.amzn1) on src)