Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openjpeg | Nov 8, 2019 | Jul 18, 2012 |
| Centos_linux | — | Upgrade openjpegUpgrade openjpeg-develUpgrade openjpeg-libs | Dec 1, 2016 | Jul 18, 2012 |
| Freebsd | — | Upgrade openjpeg | Dec 10, 2025 | May 24, 2014 |
| Gentoo Linux | — | Upgrade media-libs/openjpeg. | Oct 30, 2017 | Jul 18, 2012 |
| Oracle_linux | — | Upgrade openjpeg-develUpgrade openjpegUpgrade openjpeg-libs | Oct 16, 2024 | Jul 18, 2012 |
| Suse | — | Upgrade libopenjpeg1Upgrade openjpeg-devel | Aug 9, 2024 | Jun 28, 2013 |
| Ubuntu | — | Upgrade openjpeg | Nov 19, 2024 | Jul 18, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub