CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Openjpeg : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-14164 787 DoS Exec Code Overflow 2017-09-06 2017-10-23
6.8
None Remote Medium Not required Partial Partial Partial
A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.
2 CVE-2017-14152 787 DoS Exec Code Overflow 2017-09-05 2017-11-05
6.8
None Remote Medium Not required Partial Partial Partial
A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c and opj_j2k_write_sot in lib/openjp2/j2k.c) or possibly remote code execution.
3 CVE-2017-14151 119 DoS Exec Code Overflow 2017-09-05 2017-11-05
6.8
None Remote Medium Not required Partial Partial Partial
An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_mqc_flush in lib/openjp2/mqc.c and opj_t1_encode_cblk in lib/openjp2/t1.c) or possibly remote code execution.
4 CVE-2017-14041 787 DoS Exec Code Overflow 2017-08-30 2017-11-05
6.8
None Remote Medium Not required Partial Partial Partial
A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
5 CVE-2017-14040 787 DoS 2017-08-30 2017-11-05
6.8
None Remote Medium Not required Partial Partial Partial
An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact.
6 CVE-2017-14039 787 DoS Overflow 2017-08-30 2017-11-05
6.8
None Remote Medium Not required Partial Partial Partial
A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
7 CVE-2017-12982 119 DoS Overflow 2017-08-21 2017-10-23
4.3
None Remote Medium Not required None None Partial
The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service (memory allocation failure) in the opj_image_create function in lib/openjp2/image.c, related to the opj_aligned_alloc_n function in opj_malloc.c.
8 CVE-2016-10507 190 DoS Overflow 2017-08-30 2017-10-23
4.3
None Remote Medium Not required None None Partial
Integer overflow vulnerability in the bmp24toimage function in convertbmp.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file.
9 CVE-2016-10506 369 DoS 2017-08-30 2017-10-23
4.3
None Remote Medium Not required None None Partial
Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
10 CVE-2016-10505 476 DoS 2017-08-30 2017-10-23
4.3
None Remote Medium Not required None None Partial
NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.
11 CVE-2016-10504 119 DoS Overflow 2017-08-30 2017-11-05
4.3
None Remote Medium Not required None None Partial
Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.
12 CVE-2016-9675 119 Exec Code Overflow 2016-12-22 2016-12-23
6.8
None Remote Medium Not required Partial Partial Partial
openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. A crafted j2k image could cause the application to crash, or potentially execute arbitrary code.
13 CVE-2016-9118 119 Overflow 2016-10-30 2017-11-05
5.0
None Remote Low Not required None None Partial
Heap Buffer Overflow (WRITE of size 4) in function pnmtoimage of convert.c:1719 in OpenJPEG 2.1.2.
14 CVE-2016-9117 476 DoS 2016-10-30 2017-10-23
4.3
None Remote Medium Not required None None Partial
NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.
15 CVE-2016-9116 476 DoS 2016-10-30 2017-10-23
4.3
None Remote Medium Not required None None Partial
NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.
16 CVE-2016-9115 119 DoS Overflow 2016-10-30 2017-10-23
4.3
None Remote Medium Not required None None Partial
Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.
17 CVE-2016-9114 476 DoS 2016-10-30 2017-10-23
5.0
None Remote Low Not required None None Partial
There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2. image->comps[compno].data is not assigned a value after initialization(NULL). Impact is Denial of Service.
18 CVE-2016-9113 476 DoS 2016-10-30 2017-10-23
5.0
None Remote Low Not required None None Partial
There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image->comps[0].data is not assigned a value after initialization(NULL). Impact is Denial of Service.
19 CVE-2016-9112 369 2016-10-29 2017-10-23
5.0
None Remote Low Not required None None Partial
Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2.
20 CVE-2016-8332 119 Exec Code Overflow 2016-10-28 2017-11-03
6.8
None Remote Medium Not required Partial Partial Partial
A buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when parsing a crafted image. An exploitable code execution vulnerability exists in the jpeg2000 image file format parser as implemented in the OpenJpeg library. A specially crafted jpeg2000 file can cause an out of bound heap write resulting in heap corruption leading to arbitrary code execution. For a successful attack, the target user needs to open a malicious jpeg2000 file. The jpeg2000 image file format is mostly used for embedding images inside PDF documents and the OpenJpeg library is used by a number of popular PDF renderers making PDF documents a likely attack vector.
21 CVE-2016-7445 476 DoS 2016-10-03 2017-06-30
5.0
None Remote Low Not required None None Partial
convert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving the variable s.
22 CVE-2016-7163 125 Exec Code Overflow 2016-09-21 2016-09-21
6.8
None Remote Medium Not required Partial Partial Partial
Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
23 CVE-2016-4797 369 DoS 2017-02-03 2017-02-07
4.3
None Remote Medium Not required None None Partial
Divide-by-zero vulnerability in the opj_tcd_init_tile function in tcd.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (application crash) via a crafted jp2 file. NOTE: this issue exists because of an incorrect fix for CVE-2014-7947.
24 CVE-2016-4796 119 DoS Overflow 2017-02-03 2017-02-07
4.3
None Remote Medium Not required None None Partial
Heap-based buffer overflow in the color_cmyk_to_rgb in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (crash) via a crafted .j2k file.
25 CVE-2016-3183 125 DoS 2017-02-03 2017-02-07
4.3
None Remote Medium Not required None None Partial
The sycc422_t_rgb function in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted jpeg2000 file.
26 CVE-2016-1924 119 DoS Overflow 2016-01-27 2017-06-30
4.3
None Remote Medium Not required None None Partial
The opj_tgt_reset function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image.
27 CVE-2016-1923 119 DoS Overflow 2016-01-27 2017-06-30
4.3
None Remote Medium Not required None None Partial
Heap-based buffer overflow in the opj_j2k_update_image_data function in OpenJpeg 2016.1.18 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image.
28 CVE-2015-8871 416 2016-09-21 2017-07-07
7.5
None Remote Low Not required Partial Partial Partial
Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.
29 CVE-2015-1239 415 DoS 2017-10-18 2017-11-08
4.3
None Remote Medium Not required None None Partial
Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.
30 CVE-2013-6887 20 DoS 2014-04-27 2014-04-28
6.4
None Remote Low Not required Partial Partial None
OpenJPEG 1.5.1 allows remote attackers to cause a denial of service via unspecified vectors that trigger NULL pointer dereferences, division-by-zero, and other errors.
31 CVE-2013-6054 119 Overflow 2013-12-12 2015-07-27
7.5
None Remote Low Not required Partial Partial Partial
Heap-based buffer overflow in OpenJPEG 1.3 has unspecified impact and remote vectors, a different vulnerability than CVE-2013-6045.
32 CVE-2013-6053 20 +Info 2014-04-27 2014-04-28
5.0
None Remote Low Not required Partial None None
OpenJPEG 1.5.1 allows remote attackers to obtain sensitive information via unspecified vectors that trigger a heap-based out-of-bounds read.
33 CVE-2013-6052 200 +Info 2013-12-12 2014-01-27
5.0
None Remote Low Not required Partial None None
OpenJPEG 1.3 and earlier allows remote attackers to obtain sensitive information via unspecified vectors.
34 CVE-2013-6045 119 Exec Code Overflow 2013-12-12 2015-07-27
7.5
None Remote Low Not required Partial Partial Partial
Multiple heap-based buffer overflows in OpenJPEG 1.3 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors.
35 CVE-2013-4290 119 Overflow 2014-04-18 2016-12-30
10.0
None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in OpenJPEG before 1.5.2 allows remote attackers to have unspecified impact via unknown vectors to (1) lib/openjp3d/opj_jp3d_compress.c, (2) bin/jp3d/convert.c, or (3) lib/openjp3d/event.c.
36 CVE-2013-4289 189 Overflow 2014-04-18 2017-01-02
10.0
None Remote Low Not required Complete Complete Complete
Multiple integer overflows in lib/openjp3d/jp3d.c in OpenJPEG before 1.5.2 allow remote attackers to have unspecified impact and vectors, which trigger a heap-based buffer overflow.
37 CVE-2013-1447 DoS 2013-12-12 2014-01-27
5.0
None Remote Low Not required None None Partial
OpenJPEG 1.3 and earlier allows remote attackers to cause a denial of service (memory consumption or crash) via unspecified vectors.
38 CVE-2012-3535 119 DoS Exec Code Overflow 2012-09-05 2017-08-28
6.8
None Remote Medium Not required Partial Partial Partial
Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted JPEG2000 file.
39 CVE-2012-3358 119 DoS Exec Code Overflow 2012-07-18 2017-08-28
10.0
None Remote Low Not required Complete Complete Complete
Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file.
40 CVE-2012-1499 119 Exec Code Overflow Mem. Corr. 2012-04-11 2013-10-03
9.3
None Remote Medium Not required Complete Complete Complete
The JPEG 2000 codec (jp2.c) in OpenJPEG before 1.5 allows remote attackers to execute arbitrary code via a crafted palette index in a CMAP record of a JPEG image, which triggers memory corruption, aka "out-of heap-based buffer write."
41 CVE-2009-5030 119 DoS Exec Code Overflow Mem. Corr. 2012-07-18 2017-08-16
6.8
None Remote Medium Not required Partial Partial Partial
The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."
Total number of vulnerabilities : 41   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.