vulnerability
Amazon Linux 2023: CVE-2021-29338: Low priority package update for openjpeg2
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:L/AC:H/Au:N/C:P/I:P/A:C) | 2021-03-24 | 2025-02-17 | 2025-02-17 |
Severity
5
CVSS
(AV:L/AC:H/Au:N/C:P/I:P/A:C)
Published
2021-03-24
Added
2025-02-17
Modified
2025-02-17
Description
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
There is a flaw in the opj2_compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2_compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The greatest threat posed by this flaw is to confidentiality, integrity, and availability.
There is a flaw in the opj2_compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2_compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The greatest threat posed by this flaw is to confidentiality, integrity, and availability.
Solution(s)
amazon-linux-2023-upgrade-openjpeg2amazon-linux-2023-upgrade-openjpeg2-debuginfoamazon-linux-2023-upgrade-openjpeg2-debugsourceamazon-linux-2023-upgrade-openjpeg2-develamazon-linux-2023-upgrade-openjpeg2-devel-docsamazon-linux-2023-upgrade-openjpeg2-toolsamazon-linux-2023-upgrade-openjpeg2-tools-debuginfo
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.