PT-2021-7386 · Openjpeg+11 · Openjpeg+11

Nigelxo · Published 2021-03-24 · Updated 2025-04-02 · CVE-2021-29338

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenJPEG version 2.4.0

Description The issue is related to an integer overflow in OpenJPEG, which can be triggered by a remote attacker using the command line option "-ImgDir" on a directory containing a large number of files, specifically 1048576 files. This can cause the application to crash, resulting in a Denial of Service (DoS). The vulnerability is associated with incorrect handling of a directory with a large number of files.

Recommendations For OpenJPEG version 2.4.0, consider avoiding the use of the "-ImgDir" command line option on directories with a large number of files until a patch is available. As a temporary workaround, restrict the number of files in the directory to prevent the integer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALSA-2021:4251

ALT-PU-2022-1865

ALT-PU-2022-1892

AZL-44442

BDU:2022-05920

CESA-2021_4251

CVE-2021-29338

DLA-2975-1

DLA-4107-1

MGASA-2021-0216

OESA-2021-1363

OPENSUSE-SU-2022_1252-1

OPENSUSE-SU-2022_1296-1

OPENSUSE-SU-2024:13571-1

RHSA-2021:4251

RHSA-2021_4251

RLSA-2021:4251

ROSA-SA-2024-2537

SUSE-SU-2022:1129-1

SUSE-SU-2022:1252-1

SUSE-SU-2022:1296-1

USN-7083-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Openjpeg

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 117

• 🔥 https://github.com/uclouvain/openjpeg/issues/1338 · Exploit
• https://linux.oracle.com/errata/ELSA-2021-4251.html · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4251 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4251 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-29338 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29338 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-29338 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3575 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05920 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44442 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2021-4251.html · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1252-1 · Vendor Advisory