CVE-2017-14152
HighSummary
A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
Risk Assessment
Organizations may be exposed to attacks that could lead to system crashes or unauthorized access through remote code execution.
Recommendation
It is recommended to update to the latest version of OpenJPEG to mitigate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in OpenJPEG 2.2.0
See all- CVE-2017-14164High
A size-validation issue was discovered in opj_j2k_write_sot in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.
- CVE-2017-14151High
An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.
- CVE-2017-14041High
A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
- CVE-2017-14040High
An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact.
- CVE-2017-14039High
A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
- CVE-2016-9675High
A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045 in the openjpeg library. A crafted j2k image could cause the application to crash or potentially execute arbitrary code.
- CVE-2016-9114High
There is a NULL Pointer Access in function imagetopnm of convert.c in OpenJPEG 2.1.2. The value of image->comps[compno].data is not assigned after initialization, leading to a program crash.
- CVE-2016-9113High
There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. The image->comps[0].data is not assigned a value after initialization (NULL), leading to Denial of Service.
- CVE-2016-9112High
A floating point exception (FPE) occurs in the opj_pi_next_cprl function in OpenJPEG 2.1.2, which may lead to calculation errors, including division by zero.
- CVE-2016-8332High
A buffer overflow in OpenJPEG 2.1.1 can lead to arbitrary code execution when parsing a crafted image. Exploiting this vulnerability requires the user to open a malicious jpeg2000 file.
Original NVD description (English source)
A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c and opj_j2k_write_sot in lib/openjp2/j2k.c) or possibly remote code execution.