Summary
Frank Zeng discovered that OpenJPEG incorrectly handled memory when using
the decompression utility. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. (CVE-2024-56826,
CVE-2024-56827)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | openjpeg2 | 2.3.1-1ubuntu4.20.04.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | openjpeg2 | 2.4.0-6ubuntu0.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | openjpeg2 | 2.5.0-2ubuntu0.3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | openjpeg2 | 2.1.2-1.1+deb9u6ubuntu0.1~esm7 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | openjpeg2 | 2.3.0-2+deb10u2ubuntu0.1~esm4 |
Vulnerabilities 2
-
Medium 5.6
Openjpeg: heap buffer overflow in bin/common/color.c
A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.
-
Medium 5.6
Openjpeg: heap buffer overflow in lib/openjp2/j2k.c
A flaw was found in the OpenJPEG project. A heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.