Critical Out-of-Bounds Write Vulnerability in OpenJPEG Package
Summary
ALPINE-CVE-2017-14164: A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. Affects openjpeg versions < 2.2.0-r2. Fixed in 2.2.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenJPEG is an open-source JPEG 2000 codec that provides functionalities for encoding and decoding images in the JPEG 2000 format. It is widely used in various applications due to its efficient compression and high-quality image processing capabilities. However, the package has been found to have a critical vulnerability that can lead to severe security issues.
Vulnerability Detail
A size-validation issue was discovered in the function opj_j2k_write_sot within the OpenJPEG library. This vulnerability allows for an out-of-bounds write, potentially leading to a heap-based buffer overflow. Such an overflow can result in remote denial of service or even remote code execution. The vulnerability stems from an incomplete fix for a previous issue (CVE-2017-14152), highlighting the importance of thorough testing and validation in software development.
How To Fix
Minimum fixed version
2.2.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider restricting access to the affected application or service to trusted users only. This can help mitigate the risk of exploitation until a proper update can be applied.
Conclusion
The OpenJPEG package has a critical vulnerability that can lead to severe security issues, including remote code execution. It is crucial to update to the patched version 2.2.0-r2 to protect your systems. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for openjpeg →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include remote denial of service and the possibility of remote code execution, which can compromise the security of the affected system.
Yes, the patched version of OpenJPEG is 2.2.0-r2. Updating to this version will mitigate the vulnerability.
If immediate updating is not possible, consider implementing access restrictions to the affected application to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
