rpm package
suse/openjpeg&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
pkg:rpm/suse/openjpeg&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-27823 | — | < 1.5.2-150000.4.5.1 | 1.5.2-150000.4.5.1 | May 13, 2021 | A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. | ||
| CVE-2021-29338 | — | < 1.5.2-150000.4.5.1 | 1.5.2-150000.4.5.1 | Apr 14, 2021 | Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files. | ||
| CVE-2020-15389 | — | < 1.5.2-150000.4.5.1 | 1.5.2-150000.4.5.1 | Jun 29, 2020 | jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice | ||
| CVE-2020-8112 | — | < 1.5.2-150000.4.5.1 | 1.5.2-150000.4.5.1 | Jan 28, 2020 | opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851. | ||
| CVE-2018-16376 | — | < 1.5.2-150000.4.5.1 | 1.5.2-150000.4.5.1 | Sep 3, 2018 | An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact. | ||
| CVE-2018-14423 | — | < 1.5.2-150000.4.5.1 | 1.5.2-150000.4.5.1 | Jul 19, 2018 | Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). |
- CVE-2020-27823May 13, 2021affected < 1.5.2-150000.4.5.1fixed 1.5.2-150000.4.5.1
A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- CVE-2021-29338Apr 14, 2021affected < 1.5.2-150000.4.5.1fixed 1.5.2-150000.4.5.1
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
- CVE-2020-15389Jun 29, 2020affected < 1.5.2-150000.4.5.1fixed 1.5.2-150000.4.5.1
jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice
- CVE-2020-8112Jan 28, 2020affected < 1.5.2-150000.4.5.1fixed 1.5.2-150000.4.5.1
opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851.
- CVE-2018-16376Sep 3, 2018affected < 1.5.2-150000.4.5.1fixed 1.5.2-150000.4.5.1
An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
- CVE-2018-14423Jul 19, 2018affected < 1.5.2-150000.4.5.1fixed 1.5.2-150000.4.5.1
Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).