Skip to content
OpenAdvisories
Low ALAS2023-2023-040 2 CVEs

Low: openjpeg2 security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 22, 2023

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-1122: A flaw was found in the opj2_decompress program in openjpeg2 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service. CVE-2021-29338: There is a flaw in the opj2_compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2_compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The greatest threat posed by this flaw is to confidentiality, integrity, and availability.

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2023 openjpeg2 0:2.4.0-11.amzn2023.0.3
Amazon Linux · 2023 openjpeg2-debuginfo 0:2.4.0-11.amzn2023.0.3
Amazon Linux · 2023 openjpeg2-debugsource 0:2.4.0-11.amzn2023.0.3
Amazon Linux · 2023 openjpeg2-devel 0:2.4.0-11.amzn2023.0.3
Amazon Linux · 2023 openjpeg2-devel-docs 0:2.4.0-11.amzn2023.0.3
Amazon Linux · 2023 openjpeg2-tools 0:2.4.0-11.amzn2023.0.3
Amazon Linux · 2023 openjpeg2-tools-debuginfo 0:2.4.0-11.amzn2023.0.3

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-29338.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-1122.html