A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opjpiinitialiseencode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.

openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c.

OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG 2.5.3 and earlier, a call to opjjp2readheader may lead to OOB heap memory write when the data stream pstream is too short and pimage is not initialized.

This bug is triggered when we use opjdecompress with the -t option and its argument set to 1. The latest version v2.5.2 also has this vulnerability.

Reproducible: Always

Steps to Reproduce: see https://github.com/uclouvain/openjpeg/issues/1564

References: https://github.com/uclouvain/openjpeg/issues/1564 https://github.com/uclouvain/openjpeg/commit/e492644fbded4c820ca55b5e50e598d346e850e8

This bug is triggered when we use opjdecompress with the -r option and its argument set to 2. Version v2.5.2 also has this vulnerability.

Reproducible: Always

Steps to Reproduce: see https://github.com/uclouvain/openjpeg/issues/1563

References: https://github.com/uclouvain/openjpeg/issues/1563 https://github.com/uclouvain/openjpeg/commit/e492644fbded4c820ca55b5e50e598d346e850e8 https://bugzilla.redhat.com/showbug.cgi?id=2333954

A flaw was found in OpenJPEG. A resource exhaustion can occur in the opjt1decodecblks function in tcd.c through a crafted image file, causing a denial of service.

In openjepg, a resource exhaustion can occur in the opjt1decodecblks function in the tcd.c through a crafted image file causing a denial of service.

References:

https://github.com/uclouvain/openjpeg/issues/1474

A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.

In openjpeg, maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.

References:

https://github.com/uclouvain/openjpeg/issues/1472

A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.

A vulnerability was found in OpenJPEG where an attacker remotely sends malicious pictures to allow the program to run, which can cause denial of service and exhaust system resources.

References:

https://github.com/uclouvain/openjpeg/issues/1471 https://github.com/uclouvain/openjpeg/pull/1470

A flaw was found in the opj2decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service.

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420torgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.

Decompressing a crafted .j2k file may lead to heap-buffer-overflow in color.c:379:42 in sycc420torgb.

Reference:

https://github.com/uclouvain/openjpeg/issues/1347

Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.

Reference: https://github.com/uclouvain/openjpeg/issues/1338

Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.

A flaw was found in OpenJPEG. Specially crafted input file can lead to a heap-based buffer overflow in functions opjpinextrlcp, opjpinextrpcl and opjpinextlrcp in openjp2/pi.c.

Reference: https://github.com/uclouvain/openjpeg/issues/1302

A flaw was found in OpenJPEG. Specially crafted input file can lead to a heap-based buffer overflow in opjt2encodepacket function in openjp2/t2.c.

Reference: https://github.com/uclouvain/openjpeg/issues/1299

A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability.

A flaw was found in OpenJPEG. Specially crafted file can lead to an out-of-bounds read in opjtgtreset function in lib/openjp2/tgt.c.

Reference: https://github.com/uclouvain/openjpeg/issues/1294

A flaw was found in OpenJPEG. Specially crafted files can lead to multiple heap-based buffer overflows in lib/openjp2/pi.c.

Reference: https://github.com/uclouvain/openjpeg/issues/1293

A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

A flaw was found in OpenJPEG’s encoder in the opjdwtcalcexplicitstepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability.

A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.

jp2/opjdecompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opjimagedestroy twice.

A heap-based buffer overflow in the qmfbid==1 case in opjt1clbldecodeprocessor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28.

Upstream Issue:

https://github.com/uclouvain/openjpeg/issues/1231

Last updated 24 July 2024

Last updated 24 July 2024

In OpenJPEG 2.3.1, there is excessive iteration in the opjt1encodecblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.

Reference: https://github.com/uclouvain/openjpeg/commit/8ee335227bbcaf1614124046aa25e53d67b11ec3 https://github.com/uclouvain/openjpeg/pull/1185/commits/cbe7384016083eac16078b359acd7a842253d503

In OpenJPEG 2.3.1, there is excessive iteration in the opjt1encodecblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.

Reference: https://github.com/uclouvain/openjpeg/commit/8ee335227bbcaf1614124046aa25e53d67b11ec3 https://github.com/uclouvain/openjpeg/pull/1185/commits/cbe7384016083eac16078b359acd7a842253d503