USN-4497-1 — OpenJPEG vulnerabilities

Summary

It was discovered that OpenJPEG incorrectly handled certain image files. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2016-9112)

It was discovered that OpenJPEG did not properly handle certain input. If
OpenJPEG were supplied with specially crafted input, it could be made to crash
or potentially execute arbitrary code.
(CVE-2018-20847, CVE-2018-21010, CVE-2020-6851, CVE-2020-8112, CVE-2020-15389)

It was discovered that OpenJPEG incorrectly handled certain BMP files. A
remote attacker could possibly use this issue to cause a denial of service.
(CVE-2019-12973)

Fixed packages 1

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	openjpeg2	2.1.2-1.1+deb9u5build0.16.04.1

Vulnerabilities 7

Unscored —

CVE-2016-9112

Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2.

openjpeg2 openjpeg2 openjpeg Debian Ubuntu

Oct 29, 2016
Unscored —

CVE-2018-20847

An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in…

insighttoolkit4 qtwebengine-opensource-src openjpeg2 openjpeg2 Debian Ubuntu

Jun 26, 2019
Unscored —

CVE-2018-21010

OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.

insighttoolkit4 qtwebengine-opensource-src openjpeg2 openjpeg2 Debian Ubuntu Alpine

Sep 5, 2019
Unscored —

CVE-2019-12973

In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers c…

insighttoolkit4 qtwebengine-opensource-src openjpeg2 openjpeg2 Debian Ubuntu Alpine

Jun 26, 2019
Unscored —

CVE-2020-15389

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid an…

openjpeg2 openjpeg2 openjpeg2 openjpeg Debian Ubuntu Azure Linux Alpine

Jun 29, 2020
Unscored —

CVE-2020-6851

OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack…

ghostscript insighttoolkit4 qtwebengine-opensource-src openjpeg2 Debian Ubuntu Alpine

Jan 13, 2020
Unscored —

CVE-2020-8112

opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in t…

ghostscript insighttoolkit4 openjpeg2 qtwebengine-opensource-src Debian Ubuntu Azure Linux Alpine

Jan 28, 2020

References

report
https://ubuntu.com/security/CVE-2016-9112
report
https://ubuntu.com/security/CVE-2018-20847
report
https://ubuntu.com/security/CVE-2018-21010
report
https://ubuntu.com/security/CVE-2019-12973
report
https://ubuntu.com/security/CVE-2020-6851
report
https://ubuntu.com/security/CVE-2020-8112
report
https://ubuntu.com/security/CVE-2020-15389

OpenJPEG vulnerabilities

Summary

Fixed packages 1

Vulnerabilities 7

Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2.

An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in…

OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.

In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers c…

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid an…

OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack…

opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in t…

References