Bug#1110443: openjpeg2: CVE-2025-54874

[Salvatore Bonaccorso]

Source: openjpeg2
Version: 2.5.3-2
Severity: important
Tags: security upstream
Forwarded: https://github.com/uclouvain/openjpeg/pull/1573
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for openjpeg2.

CVE-2025-54874[0]:
| OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG 2.5.3 and
| earlier, a call to opj_jp2_read_header may lead to OOB heap memory
| write when the data stream p_stream is too short and p_image is not
| initialized.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-54874
    https://www.cve.org/CVERecord?id=CVE-2025-54874
[1] https://github.com/uclouvain/openjpeg/pull/1573
[2] https://github.com/uclouvain/openjpeg/commit/f809b80c67717c152a5ad30bf06774f00da4fd2d

Regards,
Salvatore