OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade openjpeg | Feb 7, 2020 | Jan 13, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 13, 2020 |
| Centos_linux | — | Upgrade openjpeg2Upgrade openjpeg2-devel-docsUpgrade openjpeg2-tools-debuginfoUpgrade openjpeg2-debuginfoUpgrade openjpeg2-toolsUpgrade openjpeg2-debugsourceUpgrade openjpeg2-devel | Jan 31, 2020 | Jan 13, 2020 |
| Debian | — | Upgrade openjpeg2 | Jan 30, 2020 | Jan 13, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade openjpeg2 | Feb 26, 2020 | Jan 13, 2020 |
| Oracle Solaris | — | Upgrade image/library/openjpeg2 to version 2.3.1-11.4.20.0.1.2.0 on Solaris 11.4 | Jan 19, 2021 | Jan 13, 2020 |
| Oracle_linux | — | Upgrade openjpeg2-toolsUpgrade openjpeg2-devel-docsUpgrade openjpeg2Upgrade openjpeg2-devel | Jan 29, 2020 | Jan 13, 2020 |
| Redhat_linux | — | Upgrade openjpeg2-debugsourceUpgrade openjpeg2-toolsUpgrade openjpeg2-debuginfoUpgrade openjpeg2-devel-docsUpgrade openjpeg2-tools-debuginfoUpgrade openjpeg2-develUpgrade openjpeg2 | Jan 31, 2020 | Jan 13, 2020 |
| Suse | — | Upgrade openjpeg2Upgrade openjpeg2-develUpgrade libopenjp2-7-32bitUpgrade libopenjp2-7 | Aug 9, 2024 | Jan 13, 2020 |
| Ubuntu | — | Upgrade ghostscriptUpgrade libopenjp2-7Upgrade libopenjpip7Upgrade libopenjpip7 (Ubuntu Pro)Upgrade libopenjp3d7 (Ubuntu Pro)Upgrade libopenjp2-7 (Ubuntu Pro)Upgrade libopenjp3d7Upgrade libopenjpip-dec-serverUpgrade libopenjpip-viewerUpgrade libopenjp2-toolsUpgrade libopenjpip-serverUpgrade libgs9Upgrade libopenjp3d-tools | Sep 16, 2020 | Jan 13, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub