Out-of-Bounds Affecting openjpeg2 package, versions <2.3.0-1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN11-OPENJPEG2-528343
- published 21 Aug 2017
- disclosed 21 Aug 2017
Introduced: 21 Aug 2017
CVE-2017-12982 Open this link in a new tabHow to fix?
Upgrade Debian:11 openjpeg2 to version 2.3.0-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openjpeg2 package and not the openjpeg2 package as distributed by Debian.
See How to fix? for Debian:11 relevant fixed versions and status.
The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service (memory allocation failure) in the opj_image_create function in lib/openjp2/image.c, related to the opj_aligned_alloc_n function in opj_malloc.c.
References
- https://security-tracker.debian.org/tracker/CVE-2017-12982
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12982
- https://security.gentoo.org/glsa/201710-26
- https://github.com/uclouvain/openjpeg/commit/baf0c1ad4572daa89caa3b12985bdd93530f0dd7
- https://github.com/uclouvain/openjpeg/issues/983
- https://blogs.gentoo.org/ago/2017/08/14/openjpeg-memory-allocation-failure-in-opj_aligned_alloc_n-opj_malloc-c/
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-12982