Medium ALAS2023-2025-875 1 CVE

Moderate: openjpeg2 security update (Amazon Linux 2023)

Published Feb 26, 2025 · Updated Mar 5, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-56827: openjpeg: heap buffer overflow in lib/openjp2/j2k.c

Fixed packages 7

Release	Package	Fixed in
Amazon Linux · 2023	openjpeg2	0:2.4.0-11.amzn2023.0.6
Amazon Linux · 2023	openjpeg2-debuginfo	0:2.4.0-11.amzn2023.0.6
Amazon Linux · 2023	openjpeg2-debugsource	0:2.4.0-11.amzn2023.0.6
Amazon Linux · 2023	openjpeg2-devel	0:2.4.0-11.amzn2023.0.6
Amazon Linux · 2023	openjpeg2-devel-docs	0:2.4.0-11.amzn2023.0.6
Amazon Linux · 2023	openjpeg2-tools	0:2.4.0-11.amzn2023.0.6
Amazon Linux · 2023	openjpeg2-tools-debuginfo	0:2.4.0-11.amzn2023.0.6

Vulnerabilities 1

Medium 5.6

CVE-2024-56827

Openjpeg: heap buffer overflow in lib/openjp2/j2k.c

A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux

Jan 9, 2025

References

web
https://alas.aws.amazon.com/cve/html/CVE-2024-56827.html