PT-2025-3337 · Openjpeg+8 · Openjpeg+8

Frank-Z7 · Publicado 2025-01-02 · Atualizado 2025-07-08 · CVE-2024-56827

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenJPEG (affected versions not specified)

Description A flaw was found in the OpenJPEG project, where a heap buffer overflow condition may be triggered when certain options are specified while using the opj decompress utility. This can lead to an application crash or other undefined behavior.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-122

Identificadores relacionados

ALSA-2025:7309

AZL-55447

AZL-55451

BDU:2025-03465

CVE-2024-56827

DLA-4107-1

DSA-5851-1

INFSA-2025_7309

MGASA-2025-0012

OESA-2025-1043

RHSA-2025:7309

RHSA-2025_7309

USN-7223-1

USN-7623-1

Produtos afetados

Almalinux

Astra Linux

Debian

Linuxmint

Openjpeg

Red Hat

Red Os

Rocky Linux

Ubuntu

Referências · 58

• https://github.com/uclouvain/openjpeg/issues/1564 · Nota
• https://github.com/uclouvain/openjpeg/commit/e492644fbded4c820ca55b5e50e598d346e850e8 · Nota
• https://ubuntu.com/security/CVE-2025-27835 · Aviso do Fabricante
• https://altsp.su/obnovleniya-bezopasnosti · Nota
• https://ubuntu.com/security/CVE-2023-39327 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2025-0012 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2025-0012.html · Nota de Segurança
• https://ubuntu.com/security/CVE-2025-27832 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/AWMGURRKWFOTMCKEBHYWF7HHDJSY7BTR · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2024-56827 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2024-56826 · Nota
• https://ubuntu.com/security/notices/USN-7223-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-56827 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2024-56827 · Nota de Segurança
• https://osv.dev/vulnerability/BELL-CVE-2024-56827 · Aviso do Fabricante