CVE-2018-6616: Medium severity uclouvain openjpeg vulnerability
In OpenJPEG 2.3.0, there is excessive iteration in the opjt1encodecblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjpeg2to a version that resolves this vulnerability.Fixed in 2.3.0-2Fixed in 2.1.2-1.1+deb9u3 - Upgrade
Upgrade
debian/openjpeg2to a version that resolves this vulnerability.Fixed in 2.4.0-3Fixed in 2.4.0-3+deb11u3Fixed in 2.5.0-2+deb12u3Fixed in 2.5.3-2.1~deb13u2Fixed in 2.5.4-1.1
Event History
Frequently Asked Questions
What is CVE-2018-6616?
CVE-2018-6616 is a vulnerability in OpenJPEG 2.3.0 that allows remote attackers to cause a denial of service via a crafted bmp file.
What is the severity of CVE-2018-6616?
CVE-2018-6616 has a severity level of medium.
Which software versions are affected by CVE-2018-6616?
The following software versions are affected by CVE-2018-6616: OpenJPEG 2.3.0-2+deb10u2, 2.4.0-3, 2.5.0-2, 2.3.1, 2.3.0-2, and 2.1.2-1.1+.
How can I fix CVE-2018-6616?
To fix CVE-2018-6616, update to OpenJPEG version 2.3.1 or later.
Where can I find more information about CVE-2018-6616?
You can find more information about CVE-2018-6616 at the following references: Github issue (https://github.com/uclouvain/openjpeg/issues/1059), Debian security tracker (https://security-tracker.debian.org/tracker/CVE-2018-6616), and MITRE CVE dictionary (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6616).