CVE-2024-56827: Openjpeg: heap buffer overflow in lib/openjp2/j2k.c
A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opjdecompress utility. This can lead to an application crash or other undefined behavior.
Other sources
This bug is triggered when we use opjdecompress with the -t option and its argument set to 1. The latest version v2.5.2 also has this vulnerability.
Reproducible: Always
Steps to Reproduce: see https://github.com/uclouvain/openjpeg/issues/1564
References: https://github.com/uclouvain/openjpeg/issues/1564 https://github.com/uclouvain/openjpeg/commit/e492644fbded4c820ca55b5e50e598d346e850e8
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjpeg2to a version that resolves this vulnerability.Fixed in 2.5.0-2+deb12u3Fixed in 2.5.3-2.1~deb13u2Fixed in 2.5.4-1.1 - Upgrade
Upgrade
debian/openjpeg2to a version that resolves this vulnerability.Fixed in 2.5.0-2+deb12u1 - Upgrade
Upgrade
debian/openjpeg2to a version that resolves this vulnerability.Fixed in 2.5.3-1 - Compensating control
Avoid invoking the opj_decompress utility with the -t option set to 1, which triggers the heap buffer overflow.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56827?
CVE-2024-56827 has a high severity level due to the potential for heap buffer overflow leading to application crashes.
How do I fix CVE-2024-56827?
To fix CVE-2024-56827, update the OpenJPEG package to version 2.5.0-3 or later.
What systems are affected by CVE-2024-56827?
CVE-2024-56827 affects OpenJPEG versions up to 2.4.0-3 and 2.5.0-2 on Debian-based systems.
What does CVE-2024-56827 exploit?
CVE-2024-56827 exploits a heap buffer overflow in the opj_decompress utility under specific options.
What are the potential consequences of CVE-2024-56827?
The potential consequences of CVE-2024-56827 include application crashes and undefined behavior.