Heap-based Buffer Overflow in OpenJPEG 2.2.0
Summary
CVE-2017-14039: A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0. Affects openjpeg across 2 version ranges.
< 2.3.0-r0
< c535531f03369623b9b833ef41952c62257b507e
Fixed in 2.3.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source library for handling JPEG 2000 image format. It provides functionality for encoding and decoding JPEG 2000 images. The library is widely used in various applications and systems that deal with image processing and storage. However, OpenJPEG version 2.2.0 is vulnerable to a heap-based buffer overflow.
Vulnerability Detail
The vulnerability, identified as CVE-2017-14039, resides in the opj_t2_encode_packet function in the t2.c file of OpenJPEG 2.2.0. It allows an attacker to trigger a heap-based buffer overflow, leading to potential remote denial of service or other unspecified impacts. The vulnerability arises due to an out-of-bounds write.
How To Fix
Minimum fixed version
2.3.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the official fix by upgrading OpenJPEG to a secure version.
Conclusion
The heap-based buffer overflow vulnerability in OpenJPEG 2.2.0 can have severe consequences, including remote denial of service. It is crucial to upgrade to a secure version (2.3.0-r0 or later) to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openjpeg →
FAQ
OpenJPEG is an open-source library for encoding and decoding JPEG 2000 images.
The vulnerability can result in remote denial of service or other unspecified impacts.
Upgrade OpenJPEG to version 2.3.0-r0 or later.
No, there is no known workaround. Upgrading to a secure version is necessary.
You can find more information about this vulnerability in the provided source link.
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
