vulnerability
Amazon Linux 2023: CVE-2021-29338: Low priority package update for openjpeg2
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:L/AC:H/Au:N/C:P/I:P/A:C) | Mar 24, 2021 | Feb 17, 2025 | Feb 17, 2025 |
Severity
5
CVSS
(AV:L/AC:H/Au:N/C:P/I:P/A:C)
Published
Mar 24, 2021
Added
Feb 17, 2025
Modified
Feb 17, 2025
Description
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
There is a flaw in the opj2_compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2_compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The greatest threat posed by this flaw is to confidentiality, integrity, and availability.
There is a flaw in the opj2_compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2_compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The greatest threat posed by this flaw is to confidentiality, integrity, and availability.
Solution(s)
amazon-linux-2023-upgrade-openjpeg2amazon-linux-2023-upgrade-openjpeg2-debuginfoamazon-linux-2023-upgrade-openjpeg2-debugsourceamazon-linux-2023-upgrade-openjpeg2-develamazon-linux-2023-upgrade-openjpeg2-devel-docsamazon-linux-2023-upgrade-openjpeg2-toolsamazon-linux-2023-upgrade-openjpeg2-tools-debuginfo
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.