Published: 05/09/2017 Updated: 02/02/2021

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

A mishandled zero case exists in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c and opj_j2k_write_sot in lib/openjp2/j2k.c) or possibly remote code execution.

Vulnerable Product	Search on Vulmon	Subscribe to Product
uclouvain openjpeg 2.2.0
debian debian linux 8.0
debian debian linux 9.0

Multiple vulnerabilities in OpenJPEG, a JPEG 2000 image compression / decompression library, may result in denial of service or the execution of arbitrary code if a malformed JPEG 2000 file is processed For the oldstable distribution (jessie), these problems have been fixed in version 210-2+deb8u3 For the stable distribution (stretch), these pr ...

Debian Bug report logs - #874115 openjpeg2: CVE-2017-14041: Stack-based buffer over-write in pgxtoimage function in bin/jp2/convertc Package: src:openjpeg2; Maintainer for src:openjpeg2 is Debian PhotoTools Maintainers <pkg-phototools-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> ...

Debian Bug report logs - #874431 openjpeg2: CVE-2017-14152: heap-based buffer overflow in opj_write_bytes_LE Package: src:openjpeg2; Maintainer for src:openjpeg2 is Debian PhotoTools Maintainers <pkg-phototools-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 6 Sep 2017 ...

Debian Bug report logs - #874430 openjpeg2: CVE-2017-14151: heap-based buffer overflow in opj_mqc_flush Package: src:openjpeg2; Maintainer for src:openjpeg2 is Debian PhotoTools Maintainers <pkg-phototools-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 6 Sep 2017 04:5 ...

A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2kc in OpenJPEG 220 The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cioc and opj_j2k_write_sot in lib/openjp2/j2kc) or possibly remote code e ...

CWE-787 https://github.com/uclouvain/openjpeg/issues/985 https://github.com/uclouvain/openjpeg/commit/4241ae6fbbf1de9658764a80944dc8108f2b4154 https://blogs.gentoo.org/ago/2017/08/16/openjpeg-heap-based-buffer-overflow-in-opj_write_bytes_le-cio-c/http://www.debian.org/security/2017/dsa-4013 https://nvd.nist.gov https://www.debian.org/security/./dsa-4013

CVE-2017-14152

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect