CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2020-27841 – Ubuntu Security Notice USN-5952-1
https://notcve.org/view.php?id=CVE-2020-27841
05 Jan 2021 — There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability. Se presenta un fallo en openjpeg en versiones anteriores a 2.4.0 en el archivo src/lib/openjp2/pi.c. Cuando un atacante es capaz de proporcionar una entrada diseñada para ser procesada por el codificador de openjpeg, esto podría c... • https://bugzilla.redhat.com/show_bug.cgi?id=1907510 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2020-15389 – openjpeg: use-after-free and double-free via a mix of valid and invalid files in a directory operated on by the decompressor
https://notcve.org/view.php?id=CVE-2020-15389
29 Jun 2020 — jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice. El archivo jp2/opj_decompress.c en OpenJPEG versiones hasta 2.3.1 presenta un uso de la memoria previamente liberada que puede ser desencadenada si existe una combinación de archivos válidos y no válidos en un directorio operado p... • https://github.com/uclouvain/openjpeg/issues/1261 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 2%CPEs: 2EXPL: 1CVE-2020-8112 – openjpeg: heap-based buffer overflow in pj_t1_clbl_decode_processor in openjp2/t1.c
https://notcve.org/view.php?id=CVE-2020-8112
28 Jan 2020 — opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851. La función opj_t1_clbl_decode_processor en el archivo openjp2/t1.c en OpenJPEG versión 2.3.1 hasta el 28-01-2020, presenta un desbordamiento del búfer en la región heap de la memoria en el caso qmfbid==1, un problema diferente de CVE-2020-6851. A heap-based buffer overflow flaw was found in the opj_t1_clbl_decode_processor in openjpeg... • https://access.redhat.com/errata/RHSA-2020:0550 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.1EPSS: 2%CPEs: 23EXPL: 1CVE-2020-6851 – openjpeg: Heap-based buffer overflow in opj_t1_clbl_decode_processor()
https://notcve.org/view.php?id=CVE-2020-6851
13 Jan 2020 — OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation. OpenJPEG hasta la versión 2.3.1 tiene un desbordamiento de búfer basado en almacenamiento dinámico en opj_t1_clbl_decode_processor en openjp2 / t1.c debido a la falta de validación de opj_j2k_update_image_dimensions. A heap-based buffer overflow flaw was found in openjpeg in the opj_t1_clbl_decode_processor in libopenjp2.so. Affecting versions... • https://access.redhat.com/errata/RHSA-2020:0262 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-21010 – Gentoo Linux Security Advisory 202101-29
https://notcve.org/view.php?id=CVE-2018-21010
05 Sep 2019 — OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c. OpenJPEG versiones anteriores a 2.3.1, presenta un desbordamiento del búfer de la pila en la función color_apply_icc_profile en el archivo bin/common/color.c. Multiple vulnerabilities have been found in OpenJPEG, the worst of which could result in the arbitrary execution of code. Versions less than *:1 and 2.4.0:2 are affected. • https://github.com/uclouvain/openjpeg/commit/2e5ab1d9987831c981ff05862e8ccf1381ed58ea • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2019-12973 – openjpeg: denial of service in function opj_t1_encode_cblks in openjp2/t1.c
https://notcve.org/view.php?id=CVE-2019-12973
26 Jun 2019 — In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616. En OpenJPEG versión 2.3.1, hay una iteración excesiva en la función opj_t1_encode_cblks de openjp2/t1.c. Los atacantes remotos podrían aprovechar esta vulnerabilidad para causar una denegación de servicio a través de un archivo bmp modificado. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00088.html • CWE-20: Improper Input Validation CWE-834: Excessive Iteration •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-20847 – openjpeg: integer overflow in function opj_get_encoding_parameters in openjp2/pi.c
https://notcve.org/view.php?id=CVE-2018-20847
26 Jun 2019 — An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow. Un cálculo incorrecto de p_tx0, p_tx1, p_ty0 y p_ty1 en la función opj_get_encoding_parameters en openjp2/pi.c en OpenJPEG a versión 2.3.0 puede dar lugar a un desbordamiento de enteros. OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. Issues addressed include buffer overflow, code execution, ... • http://www.securityfocus.com/bid/108921 • CWE-190: Integer Overflow or Wraparound •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20846
https://notcve.org/view.php?id=CVE-2018-20846
26 Jun 2019 — Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). Los accesos fuera de los límites en las funciones pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl y pi_next_cprl en openmj2/pi.c en OpenJPEG mediante la versión 2.3.0 permiten a los atacantes remotos causar una denegación de servicio (bloqueo de la ... • http://www.securityfocus.com/bid/108921 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20845 – openjpeg: division-by-zero in functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c
https://notcve.org/view.php?id=CVE-2018-20845
26 Jun 2019 — Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). Las vulnerabilidades de división por cero en las funciones pi_next_pcrl, pi_next_cprl y pi_next_rpcl en openmj2/pi.c en OpenJPEG mediante la versión 2.3.0 permiten a los atacantes remotos provocar una denegación de servicio (bloqueo de la aplicación). OpenJPEG is an open source library for reading and... • http://www.securityfocus.com/bid/108921 • CWE-369: Divide By Zero •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-6988
https://notcve.org/view.php?id=CVE-2019-6988
28 Jan 2019 — An issue was discovered in OpenJPEG 2.3.0. It allows remote attackers to cause a denial of service (attempted excessive memory allocation) in opj_calloc in openjp2/opj_malloc.c, when called from opj_tcd_init_tile in openjp2/tcd.c, as demonstrated by the 64-bit opj_decompress. Se ha descubierto un problema en OpenJPEG 2.3.0. Permite a los atacantes remotos provocar una denegación de servicio (intento de asignación de memoria excesiva) en opj_calloc en openjp2/opj_malloc.c cuando es llamado desde opj_tcd_init... • http://www.securityfocus.com/bid/106785 • CWE-770: Allocation of Resources Without Limits or Throttling •