Heap-based Buffer Overflow in OpenJPEG
Summary
CVE-2017-14152: A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. Affects openjpeg across 2 version ranges.
< 2.2.0-r2
< 4241ae6fbbf1de9658764a80944dc8108f2b4154
Fixed in 2.2.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source library for handling JPEG 2000 image compression. It is widely used in various applications and systems for image processing and storage. However, a vulnerability has been discovered in OpenJPEG that can lead to a heap-based buffer overflow, potentially resulting in remote denial of service or remote code execution.
Vulnerability Detail
The vulnerability, identified as CVE-2017-14152, arises from a mishandled zero case in the opj_j2k_set_cinema_parameters function in the j2k.c file of OpenJPEG 2.2.0. This flaw triggers an out-of-bounds write, which can impact the opj_write_bytes_LE function in the cio.c file and the opj_j2k_write_sot function in the j2k.c file. The consequences of this vulnerability include remote denial of service and the possibility of remote code execution.
How To Fix
Minimum fixed version
2.2.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if updating the OpenJPEG package is not immediately feasible, it is advisable to restrict access to systems or applications that utilize OpenJPEG. By limiting exposure to potentially malicious inputs, the risk of exploitation can be mitigated.
Conclusion
The heap-based buffer overflow vulnerability in OpenJPEG can have severe consequences, including remote denial of service and remote code execution. It is crucial to update the OpenJPEG package to the recommended version or apply the provided workaround to mitigate the risk. For further assistance in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for openjpeg →
FAQ
OpenJPEG is an open-source library for JPEG 2000 image compression, widely used in image processing and storage applications.
The vulnerability can lead to remote denial of service or remote code execution.
Update the OpenJPEG package to version 2.2.0-r2 or later.
Restricting access to systems or applications that use OpenJPEG can help mitigate the risk.
You can get the updated package from the official OpenJPEG repository or through your package manager.
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
