Medium: openjpeg2

Issue Overview:

Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). (CVE-2018-20845)

An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow. (CVE-2018-20847)

In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. (CVE-2018-5727)

In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. (CVE-2018-5785)

In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616. (CVE-2019-12973)

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice. (CVE-2020-15389)

A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application. (CVE-2020-27814)

A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-27823)

A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability. (CVE-2020-27824)

A flaw was found in OpenJPEG’s t2 encoder. This flaw allows an attacker who can provide crafted input to be processed by OpenJPEG to cause a NULL pointer dereference issue. The highest threat to this vulnerability is to system availability. (CVE-2020-27842)

A flaw was found in OpenJPEG. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability. (CVE-2020-27843)

A flaw was found in the src/lib/openjp2/pi.c function of OpenJPEG. This flaw allows an attacker who can provide untrusted input to OpenJPEG’s conversion/encoding functionality to cause an out-of-bounds read. The highest impact from this vulnerability is to system availability. (CVE-2020-27845)

There is a flaw in the opj2_compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2_compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The greatest threat posed by this flaw is to confidentiality, integrity, and availability. (CVE-2021-29338)

A heap-based buffer overflow was found in OpenJPEG. This flaw allows an attacker to execute arbitrary code with the permissions of the application compiled against OpenJPEG. (CVE-2021-3575)

Affected Packages:

openjpeg2

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update openjpeg2 to update your system.

New Packages:

aarch64:  
    openjpeg2-2.4.0-4.amzn2.aarch64  
    openjpeg2-devel-2.4.0-4.amzn2.aarch64  
    openjpeg2-tools-2.4.0-4.amzn2.aarch64  
    openjpeg2-debuginfo-2.4.0-4.amzn2.aarch64  
  
i686:  
    openjpeg2-2.4.0-4.amzn2.i686  
    openjpeg2-devel-2.4.0-4.amzn2.i686  
    openjpeg2-tools-2.4.0-4.amzn2.i686  
    openjpeg2-debuginfo-2.4.0-4.amzn2.i686  
  
noarch:  
    openjpeg2-devel-docs-2.4.0-4.amzn2.noarch  
  
src:  
    openjpeg2-2.4.0-4.amzn2.src  
  
x86_64:  
    openjpeg2-2.4.0-4.amzn2.x86_64  
    openjpeg2-devel-2.4.0-4.amzn2.x86_64  
    openjpeg2-tools-2.4.0-4.amzn2.x86_64  
    openjpeg2-debuginfo-2.4.0-4.amzn2.x86_64  

Additional References

Red Hat: CVE-2018-20845, CVE-2018-20847, CVE-2018-5727, CVE-2018-5785, CVE-2019-12973, CVE-2020-15389, CVE-2020-27814, CVE-2020-27823, CVE-2020-27824, CVE-2020-27842, CVE-2020-27843, CVE-2020-27845, CVE-2021-29338, CVE-2021-3575

Mitre: CVE-2018-20845, CVE-2018-20847, CVE-2018-5727, CVE-2018-5785, CVE-2019-12973, CVE-2020-15389, CVE-2020-27814, CVE-2020-27823, CVE-2020-27824, CVE-2020-27842, CVE-2020-27843, CVE-2020-27845, CVE-2021-29338, CVE-2021-3575