Critical Buffer Overflow Vulnerability in OpenJPEG Package
Summary
ALPINE-CVE-2017-14151: An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd.c in OpenJPEG 2.2.0. Affects openjpeg versions < 2.2.0-r2. Fixed in 2.2.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenJPEG is an open-source library that provides a comprehensive implementation of the JPEG 2000 image coding system. It is widely used for encoding and decoding images in various applications due to its efficiency and support for high-quality image compression. However, a critical vulnerability has been identified in versions prior to 2.2.0-r2, which may expose systems to severe risks.
Vulnerability Detail
An off-by-one error was discovered in the function opj_tcd_code_block_enc_allocate_data within the OpenJPEG library. This vulnerability can lead to an out-of-bounds write, resulting in a heap-based buffer overflow. Such an overflow can cause remote denial of service or potentially allow an attacker to execute arbitrary code on the affected system. The vulnerability is classified with a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.2.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the use of OpenJPEG in your applications or restricting access to the affected components until the update can be applied.
Conclusion
The identified vulnerability in the OpenJPEG package poses significant risks, including potential remote code execution. It is crucial for users to update to the patched version 2.2.0-r2 to mitigate these risks. For those unable to update immediately, implementing workarounds is recommended until a proper fix can be applied.
See every vulnerability recorded for openjpeg →
FAQ
The vulnerability is an off-by-one error that can lead to a heap-based buffer overflow, potentially allowing remote code execution.
All versions prior to 2.2.0-r2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Consider disabling the use of OpenJPEG or restricting access to the affected components until you can apply the update.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
