CVE-2018-21010

OpenJPEG is affected by CVE-2018-21010: a heap buffer overflow in color_apply_icc_profile (bin/common/color.c) present in OpenJPEG releases before 2.3.1. The CVE is tied to OpenJPEG under multiple advisories and Nessus/OpenVAS feeds reference this issue among OpenJPEG 2.3.x and earlier branches. ...

CVE-2020-27844

OpenJPEG vulnerability CVE-2020-27844 affects OpenJPEG before 2.4.0. A crafted input during conversion/encoding can cause an out-of-bounds write in lib/openjp2/t2.c (opj_t2_encode_packet), impacting confidentiality, integrity, and availability. Remediation: upgrade to OpenJPEG 2.4.0 or newer. Exp...

CVE-2020-27823

OpenJPEG2 contains CVE-2020-27823 affecting the OpenJPEG encoder. Connected advisories confirm multiple related issues (e.g., heap-buffer-overflow and out-of-bounds reads/writes) across OpenJPEG versions up to 2.4.0, with Affected packages including openjpeg2 and OpenJPEG 2.x components. The root...

CVE-2020-27824

OpenJPEG2 CVE-2020-27824 affects the encoder code path opj_dwt_calc_explicit_stepsizes(), where crafted input to decomposition levels can trigger a buffer overflow. The highest stated impact is to availability. Public advisories show remediations via updated openjpeg2 packages (e.g., Debian openj...

CVE-2020-27845

CVE-2020-27845 : In OpenJPEG, the flaw in src/lib/openjp2/pi.c (pre-2.4.0) allows an attacker-provided, untrusted input to trigger an out-of-bounds read during conversion/encoding, with impact to availability. Affected: OpenJPEG versions before 2.4.0. Remediation: upgrade to 2.4.0 or newer (per m...

CVE-2020-27842

CVE-2020-27842 affects the OpenJPEG2 library, specifically the t2 encoder. A crafted input to OpenJPEG prior to version 2.4.0 can trigger a null pointer dereference, with the highest impact being a denial of service through reduced availability. Connected advisories confirm OpenJPEG vulnerabiliti...

CVE-2020-27843

CVE-2020-27843 affects OpenJPEG versions before 2.4.0. A specially crafted input to the conversion or encoding path can trigger an out-of-bounds read, with the highest impact on system availability. The connected advisories consistently cite OpenJPEG2 as the vulnerable component and indicate reme...

CVE-2015-1239

CVE-2015-1239 is a vulnerability in OpenJPEG (used by PDFium in Google Chrome) where a double free in j2k_read_ppm_v3 can cause a remote-denial of service (process crash) via a crafted PDF. Affected software is OpenJPEG prior to r2997; impact is crash/DoS with no confidentiality or integrity loss...

CVE-2020-27841

CVE-2020-27841 affects the OpenJPEG2 library (openjpeg2) prior to version 2.4.0. The flaw occurs when an attacker provides crafted input to be processed by the OpenJPEG encoder, potentially causing an out-of-bounds read and impacting availability. The issue is evidenced in multiple connected advi...

CVE-2017-14039

OpenJPEG 2.2.0 is affected by CVE-2017-14039 in the opj_t2_encode_packet function (lib/openjp2/t2.c): a heap-based buffer overflow causes an out-of-bounds write, potentially enabling remote denial of service or other impact. Multiple vendor advisories (e.g., Debian DSA-4013, Mageia MGASA-2017-048...

CVE-2017-12982

Summary: CVE-2017-12982 affects OpenJPEG 2.2.0. The bmp_read_info_header function in bin/jp2/convertbmp.c fails to reject headers with a zero biBitCount, which can trigger a denial of service via memory allocation failure in opj_image_create, related to opj_aligned_alloc_n in opj_malloc.c. The vu...

CVE-2016-7163

OpenJPEG vulnerability CVE-2016-7163 is caused by an integer overflow in opj_pi_create_decode (pi.c), enabling crafted JP2 files to trigger out-of-bounds read/write and potentially execute arbitrary code. Affected: OpenJPEG library across multiple platforms; root cause and impact summarized in li...

CVE-2016-3182

CVE-2016-3182 : OpenJPEG before 2.1.1 contains a flaw in color_esycc_to_rgb (bin/common/color.c) that can cause memory corruption/denial of service when processing crafted JPEG 2000 files. Multiple connected sources corroborate the issue and link it to OpenJPEG’s j2k/tile decoding paths (e.g., co...

CVE-2017-14164

OpenJPEG 2.2.0 contains a size-validation flaw in opj_j2k_write_sot (lib/openjp2/j2k.c) that can cause an out-of-bounds write, leading to remote denial of service or possibly remote code execution. This CVE-2017-14164 is one of several vulnerabilities reported in OpenJPEG; upstream advisories not...

CVE-2016-9675

OpenJPEG vulnerability CVE-2016-9675 is a heap-based buffer overflow found in the patch for CVE-2013-6045. A crafted JPEG2000 (j2k) image could crash the application or potentially allow arbitrary code execution. The issue affects OpenJPEG releases around that era (notably 1.3 and 1.5.1 in some a...

CVE-2014-0158

CVE-2014-0158: OpenJPEG before 1.5.2 contains a heap-based buffer overflow in the JPEG2000 image tile decoder caused by incorrect interactions among j2k_decode, j2k_read_eoc, and tcd_decode_tile. This allows remote attackers to cause a denial of service (application crash) or potentially other im...