OpenJPEG vulnerabilities

A size-validation issue was discovered in opj_j2k_write_sot in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.

A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.

An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.

A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.

An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact.

A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.

A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045 in the openjpeg library. A crafted j2k image could cause the application to crash or potentially execute arbitrary code.

There is a NULL Pointer Access in function imagetopnm of convert.c in OpenJPEG 2.1.2. The value of image->comps[compno].data is not assigned after initialization, leading to a program crash.

There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. The image->comps[0].data is not assigned a value after initialization (NULL), leading to Denial of Service.

A floating point exception (FPE) occurs in the opj_pi_next_cprl function in OpenJPEG 2.1.2, which may lead to calculation errors, including division by zero.

A buffer overflow in OpenJPEG 2.1.1 can lead to arbitrary code execution when parsing a crafted image. Exploiting this vulnerability requires the user to open a malicious jpeg2000 file.

OpenJPEG before version 2.1.2 has a vulnerability that allows remote attackers to cause application crashes via NULL pointer dereference involving the variable s.

Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.

A stack-based buffer overflow in OpenJPEG before version 1.5.2 allows remote attackers to exploit unspecified vectors in the files lib/openjp3d/opj_jp3d_compress.c, bin/jp3d/convert.c, or lib/openjp3d/event.c.

Multiple integer overflows in lib/openjp3d/jp3d.c in OpenJPEG before 1.5.2 allow remote attackers to have unspecified impact, leading to a heap-based buffer overflow.

Heap Buffer Over-read in function imagetotga of convert.c(jp2):942 in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.

A NULL pointer access occurs in the imagetopnm function of convert.c (jp2):1289 in OpenJPEG 2.1.2. Exploitation requires opening a crafted j2k file.

An integer overflow vulnerability was found in the tiftoimage function in OpenJPEG 2.1.2, resulting in a heap buffer overflow.

An infinite loop vulnerability in tiftoimage that results in a heap buffer overflow in convert_32s_C1P1 was found in OpenJPEG 2.1.2.

NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) in OpenJPEG 2.1.2. Impact is Denial of Service. Someone must open a crafted j2k file.

A flaw was found in the OpenJPEG project where a heap buffer overflow condition may be triggered when certain options are specified while using the opj_decompress utility. This can lead to an application crash or other undefined behavior.

A heap buffer overflow flaw was found in the OpenJPEG project. It can be triggered when using the opj_decompress utility with certain options, leading to application crash or undefined behavior.

An integer overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when using the "-ImgDir" command line option on a directory containing 1048576 files.

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.

A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames, it calls free() on an uninitialized pointer, leading to a segmentation fault and potential denial of service.

An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.

NULL pointer dereference vulnerabilities in the imagetopnm function in convert.c, sycc444_to_rgb function in color.c, color_esycc_to_rgb function in color.c, and sycc422_to_rgb function in color.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash).

OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.

In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.

In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.

A use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before version 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.

OpenJPEG versions 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. An attacker can exploit this to cause a denial of service.

Vulnerability in uclouvain openjpeg up to 2.5.4, in the function opj_pi_initialise_encode in src/lib/openjp2/pi.c. The manipulation leads to an integer overflow; the attack must be carried out locally, and the exploit is publicly available.

A flaw was found in OpenJPEG where maliciously constructed pictures can cause the program to enter a large loop and continuously print warning messages on the terminal.

A vulnerability was found in OpenJPEG similar to CVE-2019-6988, which allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.

Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.