Oracle Outside In Technology contains a flaw that may allow a local denial of service. The issue is triggered when an error occurs in the JPG graphic import filter (ibjpg2.flt) during the handling of a component count in progressive DCT-based images (SO52). With a specially crafted quantization table selector value, a remote attacker can cause an invalid memory reference, which will result in a loss of availability.

Currently, there are no known workarounds or upgrades to correct this issue. However, Oracle has released a patch to address this vulnerability. Check the vendor advisory in the references section.

• Security Tracker: 1027669
• CVE ID: 2012-3214 (see also: NVD)
• Microsoft Knowledge Base Article: 2553234 2746157 2784126 2785908 2787763
• Secunia Advisory ID: 50993 51474
• Bugtraq ID: 55977
• Related OSVDB ID: 86392
• Vendor Specific Advisory URL: http://technet.microsoft.com/en-us/security/bulletin/ms13-feb
  http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
• Vendor URL: http://www.microsoft.com/
• Other Advisory URL: http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=63&Itemid=63
• News Article: http://www.scmagazine.com/microsoft-to-plug-57-security-holes-next-week/article/279572/
  http://www.securityweek.com/microsoft-quash-57-vulnerabilities-february
• Microsoft Security Bulletin: MS13-013

• Francis Provencher - via Secunia