Heap Buffer Overflow in OpenJPEG
Summary
CVE-2018-21010: OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c. Affects openjpeg across 2 version ranges.
< 2.3.0-r3
< 2e5ab1d9987831c981ff05862e8ccf1381ed58ea
Fixed in 2.3.0-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenJPEG is an open-source library for handling JPEG 2000 images. It provides functionality for encoding and decoding JPEG 2000 images, as well as various image manipulation operations. The library is widely used in applications that require efficient compression and decompression of images. However, a vulnerability has been discovered in OpenJPEG that could allow an attacker to execute arbitrary code or cause a denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2018-21010, is a heap buffer overflow in the color_apply_icc_profile function in the color.c file of OpenJPEG. This vulnerability occurs when processing an ICC profile embedded in an image. By exploiting this vulnerability, an attacker can overwrite adjacent memory locations, leading to arbitrary code execution or a crash of the application. The severity of this vulnerability is rated as critical with a CVSS score of 8.8.
How To Fix
Minimum fixed version
2.3.0-r3
This is the first release that contains the fix.
sudo apk add --upgrade openjpegTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the processing of ICC profiles in OpenJPEG. This can be achieved by modifying the source code or configuration settings of the application to skip the color_apply_icc_profile function. However, this workaround may impact the functionality of applications that rely on ICC profiles for color management.
Conclusion
The heap buffer overflow vulnerability in OpenJPEG can be mitigated by updating to the fixed versions of the library. It is crucial to regularly update software dependencies to ensure the latest security patches are applied. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openjpeg →
FAQ
OpenJPEG is an open-source library for handling JPEG 2000 images.
This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service.
The severity of this vulnerability is rated as critical with a CVSS score of 8.8.
To fix this vulnerability, update to the fixed version of OpenJPEG (2.3.0-r3 for Alpine Linux v3.8 and 2.3.0-r4 for Alpine Linux v3.9).
Yes, a temporary workaround is to disable the processing of ICC profiles in OpenJPEG.
Related vulnerabilities
Recent vulnerabilities recorded for openjpeg.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
