Critical Out-of-Bounds Write Vulnerability in OpenJPEG Package
Summary
ALPINE-CVE-2017-14152: A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. Affects openjpeg versions < 2.2.0-r2. Fixed in 2.2.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source library that provides a comprehensive implementation of the JPEG 2000 image coding system. It is widely used for encoding and decoding images in various applications, offering features such as lossless and lossy compression. However, OpenJPEG has been found to be vulnerable to a critical issue that can lead to severe security implications, particularly in versions prior to 2.2.0-r2.
Vulnerability Detail
A mishandled zero case was discovered in the function opj_j2k_set_cinema_parameters within the OpenJPEG library. This vulnerability leads to an out-of-bounds write, which can result in a heap-based buffer overflow. Such an overflow may cause remote denial of service or potentially allow remote code execution. The vulnerability is particularly concerning as it affects critical functions like opj_write_bytes_LE and opj_j2k_write_sot, which are essential for image processing.
How To Fix
Minimum fixed version
2.2.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted JPEG 2000 images until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The OpenJPEG library has a critical vulnerability that can lead to severe security issues if not addressed. Users are strongly advised to update to the latest patched version to mitigate risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for openjpeg →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
All versions of OpenJPEG prior to 2.2.0-r2 are affected by this vulnerability.
The vulnerability can lead to remote denial of service or remote code execution, posing significant risks to systems using the affected library.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By simply uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
Yes, Vulert provides a service that allows you to monitor your applications for vulnerabilities continuously, alerting you in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
