PT-2019-10275 · Openjpeg+3 · Openjpeg+3

Published 2019-04-03 · Updated 2023-02-27 · CVE-2018-20846

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: OpenJPEG versions prior to 2.3.1 is not mentioned, however, OpenJPEG through 2.3.0

Description: The issue is related to out-of-bounds accesses in certain functions, specifically pi next lrcp, pi next rlcp, pi next rpcl, pi next pcrl, and pi next cprl, within the openmj2/pi.c file of OpenJPEG. This allows remote attackers to cause a denial of service, resulting in an application crash.

Recommendations: For OpenJPEG through 2.3.0, consider updating to a version later than 2.3.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2019-1582

ALT-PU-2022-1865

ALT-PU-2022-1892

CVE-2018-20846

ECHO-85F8-13D6-6594

OPENSUSE-SU-2022_3802-1

OPENSUSE-SU-2022_4082-1

OPENSUSE-SU-2024:13571-1

SUSE-SU-2022:1129-1

SUSE-SU-2022:3802-1

SUSE-SU-2022:4082-1

SUSE-SU-2022_3802-1

SUSE-SU-2022_4082-1

Affected Products

Alt Linux

Debian

Openjpeg

Suse

References · 54

• https://github.com/uclouvain/openjpeg/pull/1168/commits/c277159986c80142180fbe5efb256bbf3bdf3edc · Patch
• https://osv.dev/vulnerability/SUSE-SU-2022:1129-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-20846 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20846 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:4082-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-20846 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3802-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-20846 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-20846 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-20846 · Vendor Advisory
• https://suse.com/security/cve/CVE-2018-20845 · Note
• https://suse.com/security/cve/CVE-2020-27842 · Note
• https://suse.com/security/cve/CVE-2020-27843 · Note
• https://bugzilla.suse.com/1179594 · Note