Vulnerabilities (CVE)

Filtered by vendor Uclouvain Subscribe
Total 77 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2018-21010 2 Debian, Uclouvain 2 Debian Linux, Openjpeg 2022-10-29 6.8 MEDIUM 8.8 HIGH
OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.
CVE-2022-1122 3 Debian, Fedoraproject, Uclouvain 3 Debian Linux, Fedora, Openjpeg 2022-10-27 4.3 MEDIUM 5.5 MEDIUM
A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service.
CVE-2020-27814 2 Debian, Uclouvain 2 Debian Linux, Openjpeg 2022-10-07 6.8 MEDIUM 7.8 HIGH
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.
CVE-2020-27844 3 Debian, Oracle, Uclouvain 3 Debian Linux, Outside In Technology, Openjpeg 2022-10-07 8.3 HIGH 7.8 HIGH
A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVE-2020-27845 4 Debian, Fedoraproject, Oracle and 1 more 4 Debian Linux, Fedora, Outside In Technology and 1 more 2022-10-06 4.3 MEDIUM 5.5 MEDIUM
There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability.
CVE-2020-27841 4 Debian, Fedoraproject, Oracle and 1 more 4 Debian Linux, Fedora, Outside In Technology and 1 more 2022-10-06 4.3 MEDIUM 5.5 MEDIUM
There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability.
CVE-2020-15389 3 Debian, Oracle, Uclouvain 3 Debian Linux, Outside In Technology, Openjpeg 2022-10-06 5.8 MEDIUM 6.5 MEDIUM
jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.
CVE-2019-12973 4 Debian, Opensuse, Oracle and 1 more 5 Debian Linux, Leap, Database Server and 2 more 2022-10-05 4.3 MEDIUM 5.5 MEDIUM
In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.
CVE-2021-29338 3 Debian, Fedoraproject, Uclouvain 3 Debian Linux, Fedora, Openjpeg 2022-09-30 4.3 MEDIUM 5.5 MEDIUM
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
CVE-2020-27824 4 Debian, Fedoraproject, Redhat and 1 more 4 Debian Linux, Fedora, Enterprise Linux and 1 more 2022-08-05 4.3 MEDIUM 5.5 MEDIUM
A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability.
CVE-2021-3575 3 Fedoraproject, Redhat, Uclouvain 3 Fedora, Enterprise Linux, Openjpeg 2022-07-21 6.8 MEDIUM 7.8 HIGH
A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.
CVE-2020-27843 4 Debian, Fedoraproject, Oracle and 1 more 4 Debian Linux, Fedora, Outside In Technology and 1 more 2022-06-16 7.1 HIGH 5.5 MEDIUM
A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability.
CVE-2020-27842 5 Debian, Fedoraproject, Oracle and 2 more 11 Debian Linux, Extra Packages For Enterprise Linux, Fedora and 8 more 2022-06-14 4.3 MEDIUM 5.5 MEDIUM
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.
CVE-2020-6851 5 Debian, Fedoraproject, Oracle and 2 more 12 Debian Linux, Fedora, Georaster and 9 more 2022-04-29 5.0 MEDIUM 7.5 HIGH
OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.
CVE-2016-8332 1 Uclouvain 1 Openjpeg 2022-04-19 6.8 MEDIUM 7.8 HIGH
A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. An exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful attack, the target user needs to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents and the OpenJpeg library is used by a number of popular PDF renderers making PDF documents a likely attack vector.
CVE-2016-7163 4 Debian, Fedoraproject, Redhat and 1 more 9 Debian Linux, Fedora, Enterprise Linux Desktop and 6 more 2022-04-07 6.8 MEDIUM 7.8 HIGH
Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
CVE-2015-1239 3 Debian, Google, Uclouvain 4 Debian Linux, Chrome, Pdfium and 1 more 2021-11-09 4.3 MEDIUM 6.5 MEDIUM
Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.
CVE-2020-27823 3 Debian, Fedoraproject, Uclouvain 3 Debian Linux, Fedora, Openjpeg 2021-06-02 6.8 MEDIUM 7.8 HIGH
A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
CVE-2020-8112 2 Debian, Uclouvain 2 Debian Linux, Openjpeg 2021-04-02 6.8 MEDIUM 8.8 HIGH
opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851.
CVE-2018-5785 3 Canonical, Debian, Uclouvain 3 Ubuntu Linux, Debian Linux, Openjpeg 2021-02-03 4.3 MEDIUM 6.5 MEDIUM
In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.