Three vulnerabilities have been reported in Oracle Outside In Technology, which can be exploited to malicious people to compromise an application using the library.

1) An unspecified error exists in the JPEG 2000 filter.

2) Another unspecified error exists in the JPEG 2000 filter.

3) An unspecified error exists in the Lotus 123 v4 parser.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

The vulnerabilities are reported in versions 8.3.5 and 8.3.7.

Solution
Apply updates (please see the vendor's advisory for details).

Provided and/or discovered by
3) Will Dormann, CERT/CC.

An anonymous person via ZDI.

It is currently unclear who reported the remaining vulnerabilities as the Oracle Critical Patch Update for January 2012 only provides a bundled list of credits. This section will be updated when/if the original reporters provide more information.

Changelog
Further details available in Customer Area

Original Advisory
Oracle:
http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html

US-CERT VU#738961:
http://www.kb.cert.org/vuls/id/738961

ZDI:
http://www.zerodayinitiative.com/advisories/ZDI-12-017/

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area