In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in
    jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of
    service or possibly remote code execution. (CVE-2017-17480)

  - In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c.
    Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
    (CVE-2018-6616)

  - Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in
    lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service
    (application crash). (CVE-2018-14423)

  - OpenJPEG 2.3.0 has a NULL pointer dereference for "red" in the imagetopnm function of jp2/convert.c
    (CVE-2018-18088)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4109-1 advisory.

    It was discovered that OpenJPEG incorrectly handled certain PGX files. An attacker could possibly use this     issue to cause a denial of service or possibly remote code execution. (CVE-2017-17480)

    It was discovered that OpenJPEG incorrectly handled certain files. An attacker could possibly use this     issue to cause a denial of service. (CVE-2018-14423)

    It was discovered that OpenJPEG incorrectly handled certain PNM files. An attacker could possibly use this     issue to cause a denial of service. (CVE-2018-18088)

    It was discovered that OpenJPEG incorrectly handled certain BMP files. An attacker could possibly use this     issue to cause a denial of service. (CVE-2018-5785, CVE-2018-6616)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the openjpeg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in mj2/opj_mj2_extract.c in     OpenJPEG 2.3.0. The output prefix was not checked for     length, which could overflow a buffer, when providing a     prefix with 50 or more characters on the command     line.(CVE-2018-7648)

  - In OpenJPEG 2.3.0, a stack-based buffer overflow was     discovered in the pgxtovolume function in     jp3d/convert.c. The vulnerability causes an     out-of-bounds write, which may lead to remote denial of     service or possibly remote code     execution.(CVE-2017-17480)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in openjpeg2, the open-source JPEG 2000 codec, that could be leveraged to cause a denial of service or possibly remote code execution.

  - CVE-2017-17480     Write stack-based buffer overflow in the jp3d and jpwl     codecs can result in a denial of service or remote code     execution via a crafted jp3d or jpwl file.

  - CVE-2018-5785     Integer overflow can result in a denial of service via a     crafted bmp file.

  - CVE-2018-6616     Excessive iteration can result in a denial of service     via a crafted bmp file.

  - CVE-2018-14423     Division-by-zero vulnerabilities can result in a denial     of service via a crafted j2k file.

  - CVE-2018-18088     NULL pointer dereference can result in a denial of     service via a crafted bmp file.

Multiple vulnerabilities have been discovered in openjpeg2, the open-source JPEG 2000 codec.

CVE-2017-17480

Write stack-based buffer overflow due to missing buffer length formatter in fscanf call (jp3d and jpwl codecs). This vulnerability might be leveraged by remote attackers using crafted jp3d and jpwl files to cause denial of service or possibly remote code execution.

CVE-2018-18088

NULL pointer dereference caused by null image components in imagetopnm. This vulnerability might be leveraged by remote attackers using crafted BMP files to cause denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 2.1.0-2+deb8u5.

We recommend that you upgrade your openjpeg2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

OpenJPEG reports :

Multiple vulnerabilities have been found in OpenJPEG, the opensource JPEG 2000 codec. Please consult the CVE list for further details.

CVE-2017-17479 and CVE-2017-17480 were fixed in r477112.

CVE-2018-5785 was fixed in r480624.

CVE-2018-6616 was fixed in r489415.

This update for openjpeg2 fixes the following security issues :

  - CVE-2015-1239: A double free vulnerability in the     j2k_read_ppm_v3 function allowed remote attackers to     cause a denial of service (crash) (bsc#1066713)

  - CVE-2017-17479: A stack-based buffer overflow in the     pgxtoimage function in jpwl/convert.c could crash the     converter. (bsc#1072125)

  - CVE-2017-17480: A stack-based buffer overflow in the     pgxtovolume function in jp3d/convert.c could crash the     converter. (bsc#1072124)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for openjpeg2 fixes the following security issues :

  - CVE-2015-1239: A double free vulnerability in the     j2k_read_ppm_v3 function allowed remote attackers to     cause a denial of service (crash) (bsc#1066713)

  - CVE-2017-17479: A stack-based buffer overflow in the     pgxtoimage function in jpwl/convert.c could crash the     converter. (bsc#1072125)

  - CVE-2017-17480: A stack-based buffer overflow in the     pgxtovolume function in jp3d/convert.c could crash the     converter. (bsc#1072124)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
424271	Alpine: multiple openjpeg packages: security update to 2.3.0-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
424271	Alpine: multiple openjpeg packages: security update to 2.3.0-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
128076	Ubuntu 18.04 LTS : OpenJPEG vulnerabilities (USN-4109-1)	Nessus	Ubuntu Local Security Checks	critical
127012	EulerOS 2.0 SP8 : openjpeg2 (EulerOS-SA-2019-1775)	Nessus	Huawei Local Security Checks	critical
122724	Debian DSA-4405-1 : openjpeg2 - security update	Nessus	Debian Local Security Checks	critical
119052	Debian DLA-1579-1 : openjpeg2 security update	Nessus	Debian Local Security Checks	critical
111404	FreeBSD : OpenJPEG -- multiple vulnerabilities (11dc3890-0e64-11e8-99b0-d017c2987f9a)	Nessus	FreeBSD Local Security Checks	critical
110064	openSUSE Security Update : openjpeg2 (openSUSE-2018-490)	Nessus	SuSE Local Security Checks	critical
110031	SUSE SLED12 / SLES12 Security Update : openjpeg2 (SUSE-SU-2018:1364-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-17480

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical