PT-2017-7904 · Openjpeg+2 · Openjpeg+2

Trylab · Publicado 2017-08-19 · Atualizado 2022-10-07 · CVE-2016-10506

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenJPEG versions prior to 2.2.0

Description The issue is related to division-by-zero vulnerabilities in certain functions, specifically opj pi next cprl, opj pi next pcrl, and opj pi next rpcl, which are located in the pi.c file. These vulnerabilities can be exploited by remote attackers using crafted j2k files, leading to a denial of service in the form of an application crash.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue.

Correção

DoS

Divide By Zero

Enumeração de Fraquezas

CWE-369

Identificadores relacionados

ALT-PU-2017-2084

CVE-2016-10506

OPENSUSE-SU-2024:11120-1

USN-4782-1

USN-5664-1

Produtos afetados

Alt Linux

Openjpeg

Ubuntu

Referências · 30

• https://github.com/uclouvain/openjpeg/issues/779 · Correção
• https://github.com/uclouvain/openjpeg/issues/780 · Correção
• https://github.com/uclouvain/openjpeg/issues/732 · Correção
• https://github.com/uclouvain/openjpeg/issues/778 · Correção
• https://github.com/uclouvain/openjpeg/commit/d27ccf01c68a31ad62b33d2dc1ba2bb1eeaafe7b · Correção
• https://github.com/uclouvain/openjpeg/issues/731 · Correção
• https://github.com/uclouvain/openjpeg/issues/777 · Correção
• http://securityfocus.com/bid/100573 · Nota
• https://ubuntu.com/security/CVE-2016-9112 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-20845 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-5664-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-17479 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2020-27824 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10506 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-10506 · Aviso do Fabricante