CVE-2021-3575: Buffer Overflow
A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420torgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.
Other sources
Decompressing a crafted .j2k file may lead to heap-buffer-overflow in color.c:379:42 in sycc420torgb.
Reference:
https://github.com/uclouvain/openjpeg/issues/1347
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-3575?
CVE-2021-3575 is a heap-based buffer overflow vulnerability found in openjpeg.
How does CVE-2021-3575 allow an attacker to execute arbitrary code?
An attacker can exploit CVE-2021-3575 by using a crafted .j2k file to trigger the buffer overflow and execute arbitrary code.
Which software versions are affected by CVE-2021-3575?
Uclouvain Openjpeg 2.4.0, Redhat Enterprise Linux 6.0, Redhat Enterprise Linux 7.0, Redhat Enterprise Linux 8.0, Fedoraproject Fedora 33, and Fedoraproject Fedora 34 are affected by CVE-2021-3575.
What is the severity of CVE-2021-3575?
The severity of CVE-2021-3575 is high, with a CVSS score of 7.8.
How can I mitigate CVE-2021-3575?
To mitigate CVE-2021-3575, it is recommended to update to the latest version of the affected software or apply any patches or fixes provided by the vendor.