PT-2019-5742 · Openjpeg+3 · Openjpeg+3

Published 2019-04-03 · Updated 2022-11-18 · CVE-2018-21010

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenJPEG versions prior to 2.3.1

Description The issue is related to a heap buffer overflow in the color apply icc profile function, located in bin/common/color.c. This can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the color apply icc profile function until a patch is available.

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

ALT-PU-2019-1582

BDU:2021-01282

CVE-2018-21010

DLA-1950-1

OPENSUSE-SU-2022_3802-1

OPENSUSE-SU-2022_4082-1

OPENSUSE-SU-2024:13571-1

SUSE-SU-2022:3801-1

SUSE-SU-2022:3802-1

SUSE-SU-2022:4082-1

SUSE-SU-2022_3801-1

USN-4497-1

Affected Products

Alt Linux

Openjpeg

Suse

Ubuntu

References · 48

• https://github.com/uclouvain/openjpeg/commit/2e5ab1d9987831c981ff05862e8ccf1381ed58ea · Patch
• https://ubuntu.com/security/CVE-2016-9112 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-21010 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-21010 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4082-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3801-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01282 · Security Note
• https://ubuntu.com/security/CVE-2020-6851 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-21010 · Security Note
• https://ubuntu.com/security/CVE-2018-21010 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-20847 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1950-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-21010 · Vendor Advisory
• https://security.gentoo.org/glsa/202101-29 · Vendor Advisory