A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opjdecompress utility. This can lead to an application crash or other undefined behavior.
This bug is triggered when we use opjdecompress with the -t option and its argument set to 1. The latest version v2.5.2 also has this vulnerability.
Reproducible: Always
Steps to Reproduce: see https://github.com/uclouvain/openjpeg/issues/1564
References: https://github.com/uclouvain/openjpeg/issues/1564 https://github.com/uclouvain/openjpeg/commit/e492644fbded4c820ca55b5e50e598d346e850e8
A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opjdecompress utility. This can lead to an application crash or other undefined behavior.
This bug is triggered when we use opjdecompress with the -r option and its argument set to 2. Version v2.5.2 also has this vulnerability.
Reproducible: Always
Steps to Reproduce: see https://github.com/uclouvain/openjpeg/issues/1563
References: https://github.com/uclouvain/openjpeg/issues/1563 https://github.com/uclouvain/openjpeg/commit/e492644fbded4c820ca55b5e50e598d346e850e8 https://bugzilla.redhat.com/showbug.cgi?id=2333954
In openjepg, a resource exhaustion can occur in the opjt1decodecblks function in the tcd.c through a crafted image file causing a denial of service.
References:
https://github.com/uclouvain/openjpeg/issues/1474
In openjpeg, maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.
References:
https://github.com/uclouvain/openjpeg/issues/1472
A vulnerability was found in OpenJPEG where an attacker remotely sends malicious pictures to allow the program to run, which can cause denial of service and exhaust system resources.
References:
https://github.com/uclouvain/openjpeg/issues/1471 https://github.com/uclouvain/openjpeg/pull/1470
A flaw was found in the opj2decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service.
A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420torgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.
Decompressing a crafted .j2k file may lead to heap-buffer-overflow in color.c:379:42 in sycc420torgb.
Reference:
https://github.com/uclouvain/openjpeg/issues/1347
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
Reference: https://github.com/uclouvain/openjpeg/issues/1338
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
It was discovered that OpenJPEG incorrectly handled certain image files. A remote attacker could possibly use this issue to cause a denial of service. CVE-2016-10506 and CVE-2017-12982 affected only Ubuntu 16.04 ESM. CVE-2018-16375, CVE-2018-20845 and CVE-2019-12973 affected only Ubuntu 18.04 ESM.
It was discovered that OpenJPEG incorrectly handled certain image data. An attacker could use this issue to cause OpenJPEG to crash, leading to a denial of service, or possibly execute arbitrary code.
A flaw was found in OpenJPEG. Specially crafted input file can lead to a heap-based buffer overflow in functions opjpinextrlcp, opjpinextrpcl and opjpinextlrcp in openjp2/pi.c.
Reference: https://github.com/uclouvain/openjpeg/issues/1302
A flaw was found in OpenJPEG. Specially crafted input file can lead to a heap-based buffer overflow in opjt2encodepacket function in openjp2/t2.c.
Reference: https://github.com/uclouvain/openjpeg/issues/1299
A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability.
A flaw was found in OpenJPEG. Specially crafted file can lead to an out-of-bounds read in opjtgtreset function in lib/openjp2/tgt.c.
Reference: https://github.com/uclouvain/openjpeg/issues/1294
A flaw was found in OpenJPEG. Specially crafted files can lead to multiple heap-based buffer overflows in lib/openjp2/pi.c.
Reference: https://github.com/uclouvain/openjpeg/issues/1293
A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
A flaw was found in OpenJPEG’s encoder in the opjdwtcalcexplicitstepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability.
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.
It was discovered that OpenJPEG incorrectly handled certain image files. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2016-9112) It was discovered that OpenJPEG did not properly handle certain input. If OpenJPEG were supplied with specially crafted input, it could be made to crash or potentially execute arbitrary code. (CVE-2018-20847, CVE-2018-21010, CVE-2020-6851, CVE-2020-8112, CVE-2020-15389) It was discovered that OpenJPEG incorrectly handled certain BMP files. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2019-12973)
jp2/opjdecompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opjimagedestroy twice.
Reference: https://github.com/uclouvain/openjpeg/issues/1261
jp2/opjdecompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opjimagedestroy twice.
A heap-based buffer overflow in the qmfbid==1 case in opjt1clbldecodeprocessor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28.
Upstream Issue:
https://github.com/uclouvain/openjpeg/issues/1231
OpenJPEG through 2.3.1 has a heap-based buffer overflow in opjt1clbldecodeprocessor in libopenjp2.so.
Upstream Issue:
https://github.com/uclouvain/openjpeg/issues/1228
Last updated 24 July 2024
In OpenJPEG 2.3.1, there is excessive iteration in the opjt1encodecblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
Reference: https://github.com/uclouvain/openjpeg/commit/8ee335227bbcaf1614124046aa25e53d67b11ec3 https://github.com/uclouvain/openjpeg/pull/1185/commits/cbe7384016083eac16078b359acd7a842253d503
In OpenJPEG 2.3.1, there is excessive iteration in the opjt1encodecblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
Reference: https://github.com/uclouvain/openjpeg/commit/8ee335227bbcaf1614124046aa25e53d67b11ec3 https://github.com/uclouvain/openjpeg/pull/1185/commits/cbe7384016083eac16078b359acd7a842253d503