rpm package
suse/openjpeg2&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
pkg:rpm/suse/openjpeg2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS
Vulnerabilities (21)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-1122 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | Mar 29, 2022 | A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a se | ||
| CVE-2020-27823 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | May 13, 2021 | A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. | ||
| CVE-2020-27824 | — | < 2.3.0-150000.3.8.1 | 2.3.0-150000.3.8.1 | May 13, 2021 | A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability. | ||
| CVE-2021-29338 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | Apr 14, 2021 | Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files. | ||
| CVE-2020-27814 | — | < 2.3.0-150000.3.8.1 | 2.3.0-150000.3.8.1 | Jan 25, 2021 | A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application. | ||
| CVE-2020-27845 | — | < 2.3.0-150000.3.8.1 | 2.3.0-150000.3.8.1 | Jan 5, 2021 | There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability | ||
| CVE-2020-27843 | — | < 2.3.0-150000.3.8.1 | 2.3.0-150000.3.8.1 | Jan 5, 2021 | A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability. | ||
| CVE-2020-27842 | — | < 2.3.0-150000.3.8.1 | 2.3.0-150000.3.8.1 | Jan 5, 2021 | There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability. | ||
| CVE-2020-27841 | — | < 2.3.0-150000.3.8.1 | 2.3.0-150000.3.8.1 | Jan 5, 2021 | There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability. | ||
| CVE-2020-15389 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | Jun 29, 2020 | jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice | ||
| CVE-2020-8112 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | Jan 28, 2020 | opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851. | ||
| CVE-2020-6851 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | Jan 13, 2020 | OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation. | ||
| CVE-2018-21010 | — | < 2.3.0-150000.3.8.1 | 2.3.0-150000.3.8.1 | Sep 5, 2019 | OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c. | ||
| CVE-2018-20846 | — | < 2.3.0-150000.3.8.1 | 2.3.0-150000.3.8.1 | Jun 26, 2019 | Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). | ||
| CVE-2018-20845 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | Jun 26, 2019 | Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). | ||
| CVE-2018-16376 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | Sep 3, 2018 | An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact. | ||
| CVE-2018-16375 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | Sep 3, 2018 | An issue was discovered in OpenJPEG 2.3.0. Missing checks for header_info.height and header_info.width in the function pnmtoimage in bin/jpwl/convert.c can lead to a heap-based buffer overflow. | ||
| CVE-2018-14423 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | Jul 19, 2018 | Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). | ||
| CVE-2018-6616 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | Feb 4, 2018 | In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. | ||
| CVE-2018-5785 | — | < 2.3.0-150000.3.5.1 | 2.3.0-150000.3.5.1 | Jan 19, 2018 | In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. |
- CVE-2022-1122Mar 29, 2022affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a se
- CVE-2020-27823May 13, 2021affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- CVE-2020-27824May 13, 2021affected < 2.3.0-150000.3.8.1fixed 2.3.0-150000.3.8.1
A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability.
- CVE-2021-29338Apr 14, 2021affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
- CVE-2020-27814Jan 25, 2021affected < 2.3.0-150000.3.8.1fixed 2.3.0-150000.3.8.1
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.
- CVE-2020-27845Jan 5, 2021affected < 2.3.0-150000.3.8.1fixed 2.3.0-150000.3.8.1
There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability
- CVE-2020-27843Jan 5, 2021affected < 2.3.0-150000.3.8.1fixed 2.3.0-150000.3.8.1
A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability.
- CVE-2020-27842Jan 5, 2021affected < 2.3.0-150000.3.8.1fixed 2.3.0-150000.3.8.1
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.
- CVE-2020-27841Jan 5, 2021affected < 2.3.0-150000.3.8.1fixed 2.3.0-150000.3.8.1
There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability.
- CVE-2020-15389Jun 29, 2020affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice
- CVE-2020-8112Jan 28, 2020affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851.
- CVE-2020-6851Jan 13, 2020affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.
- CVE-2018-21010Sep 5, 2019affected < 2.3.0-150000.3.8.1fixed 2.3.0-150000.3.8.1
OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.
- CVE-2018-20846Jun 26, 2019affected < 2.3.0-150000.3.8.1fixed 2.3.0-150000.3.8.1
Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
- CVE-2018-20845Jun 26, 2019affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
- CVE-2018-16376Sep 3, 2018affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
- CVE-2018-16375Sep 3, 2018affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
An issue was discovered in OpenJPEG 2.3.0. Missing checks for header_info.height and header_info.width in the function pnmtoimage in bin/jpwl/convert.c can lead to a heap-based buffer overflow.
- CVE-2018-14423Jul 19, 2018affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
- CVE-2018-6616Feb 4, 2018affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
- CVE-2018-5785Jan 19, 2018affected < 2.3.0-150000.3.5.1fixed 2.3.0-150000.3.5.1
In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
Page 1 of 2