CVE-2023-39327
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A flaw was found in OpenJPEG where maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.
Risk Assessment
A remote attacker can supply a crafted image, causing excessive CPU usage and log flooding, potentially leading to a denial of service (DoS).
Recommendation
Update OpenJPEG to a version that fixes the infinite loop when processing malicious images.
Other vulnerabilities in OpenJPEG
See all- CVE-2017-14164High
A size-validation issue was discovered in opj_j2k_write_sot in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.
- CVE-2017-14152High
A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
- CVE-2017-14151High
An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.
- CVE-2017-14041High
A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
- CVE-2017-14040High
An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact.
- CVE-2017-14039High
A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
- CVE-2016-9675High
A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045 in the openjpeg library. A crafted j2k image could cause the application to crash or potentially execute arbitrary code.
- CVE-2016-9114High
There is a NULL Pointer Access in function imagetopnm of convert.c in OpenJPEG 2.1.2. The value of image->comps[compno].data is not assigned after initialization, leading to a program crash.
- CVE-2016-9113High
There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. The image->comps[0].data is not assigned a value after initialization (NULL), leading to Denial of Service.
- CVE-2016-9112High
A floating point exception (FPE) occurs in the opj_pi_next_cprl function in OpenJPEG 2.1.2, which may lead to calculation errors, including division by zero.
Original NVD description (English source)
A flaw was found in OpenJPEG. Maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS