REDHAT-BUG-2015308: Medium severity ORACLE OpenJDK vulnerability
Published Oct 18, 2021
·Updated
A flaw was found in the way the BMPImageReader class implementation in the ImageIO component of OpenJDK handled memory allocations when processing uncompressed BMP images. A specially-crafted BMP image with a small size could cause a Java application to allocate an excessive amount of memory and possibly terminate on out-of-memory condition.
Affected Software
1 affected component
ORACLE OpenJDK
Event History
Oct 18, 2021
Data Sourced
via Red Hat·08:35 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What does an attacker need to do to trigger this issue?
An attacker needs to provide a specially crafted uncompressed BMP image to an application that processes it using the affected OpenJDK ImageIO BMPImageReader implementation.
2
What is the likely impact on an affected application?
Processing the crafted image can cause excessive memory allocation even when the BMP file is small. This may exhaust available memory and terminate the Java application with an out-of-memory condition.