Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OpenJPEG: Multiple vulnerabilites #4270

Closed
CamberLoid opened this issue Oct 24, 2022 · 1 comment
Closed

OpenJPEG: Multiple vulnerabilites #4270

CamberLoid opened this issue Oct 24, 2022 · 1 comment
Labels
has-fix Topic contains a fix for a known issue security Topic/issue involves a security issue/fixed

Comments

@CamberLoid
Copy link
Member

CVE IDs

(Omitted. See below)

Other security advisory IDs

Description

OpenJPEG (package name: openjpeg) has discovered and fixed several security vulnerabilities between 2.3.1 (current) and 2.5.0, Including the following:

  • CVE-2022-1122: A flaw in opj2_decompress may call free() on an uninitialized pointer, leading to a segmentation fault and a denial of service;
  • CVE-2021-29338: Integer overflow. May lead to a DoS when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files;
  • CVE-2020-2784{1..4}, 27823, 27824, 27814: Multiple vulnerabilities of buffer overflow.
  • CVE-2020-15389: Use after free;
  • CVE-2020-8112: heap-based buffer overflow;
  • CVE-2020-6851: heap-based buffer overflow;
  • CVE-2020-12973: Potential DoS;

Patches

In general, an update to 2.5.0 will solve these problems.

PoC(s)

N/A
@CamberLoid CamberLoid added the security Topic/issue involves a security issue/fixed label Oct 24, 2022
CamberLoid added a commit that referenced this issue Oct 24, 2022
@CamberLoid
openjpeg: update to 2.5.0 (Security, #4270)
b732e0f 
* Fix some vulnerabilities. See issue for more details.
* Add jbigkit as builddep, which only includes static library.

Signed-off-by: Camber Huang <camber@poi.science>
@CamberLoid CamberLoid added the has-fix Topic contains a fix for a known issue label Oct 24, 2022
CamberLoid added a commit that referenced this issue Nov 10, 2022
@CamberLoid
openjpeg: update to 2.5.0 (Security, #4270)
4fb3ded 
* Fix some vulnerabilities. See issue for more details.
* Add jbigkit as builddep, which only includes static library.

Signed-off-by: Camber Huang <camber@poi.science>
CamberLoid added a commit that referenced this issue Nov 11, 2022
@CamberLoid
openjpeg: update to 2.5.0 (Security, #4270)
a7f10e9 
* Fix some vulnerabilities. See issue for more details.
* Add jbigkit as builddep, which only includes static library.

Signed-off-by: Camber Huang <camber@poi.science>
CamberLoid added a commit that referenced this issue Nov 12, 2022
@CamberLoid
openjpeg: update to 2.5.0 (Security, #4270)
1d9fc10 
* Fix some vulnerabilities. See issue for more details.
* Add jbigkit as builddep, which only includes static library.

Signed-off-by: Camber Huang <camber@poi.science>
CamberLoid added a commit that referenced this issue Nov 23, 2022
@CamberLoid
openjpeg: update to 2.5.0 (Security, #4270)
67603a0 
* Fix some vulnerabilities. See issue for more details.
* Add jbigkit as builddep, which only includes static library.

Signed-off-by: Camber Huang <camber@poi.science>
CamberLoid added a commit that referenced this issue Nov 27, 2022
@CamberLoid
openjpeg: update to 2.5.0 (Security, #4270)
f1c3b85 
* Fix some vulnerabilities. See issue for more details.
* Add jbigkit as builddep, which only includes static library.

Signed-off-by: Camber Huang <camber@poi.science>
CamberLoid added a commit that referenced this issue Nov 27, 2022
@CamberLoid
openjpeg: update to 2.5.0 (Security, #4270)
27d4e73 
* Fix some vulnerabilities. See issue for more details.
* Add jbigkit as builddep, which only includes static library.

Signed-off-by: Camber Huang <camber@poi.science>
@CamberLoid
Copy link
Member Author

Fixed via #4290

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
has-fix Topic contains a fix for a known issue security Topic/issue involves a security issue/fixed
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@CamberLoid