Alpine: multiple openjpeg packages: security update to 2.2.0-r1 (deprecated)

high Tenable Self-Hosted Container Security Plugin ID 400812

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The
vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer
overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this
vulnerability exists because of an incomplete fix for CVE-2017-14152. (CVE-2017-14164)

- A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in
OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of
service or possibly unspecified other impact. (CVE-2017-14039)

- An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the
tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other
impact. (CVE-2017-14040)

- A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG
2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or
possibly remote code execution. (CVE-2017-14041)

- An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd.c in
OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of
service (heap-based buffer overflow affecting opj_mqc_flush in lib/openjp2/mqc.c and opj_t1_encode_cblk in
lib/openjp2/t1.c) or possibly remote code execution. (CVE-2017-14151)

Plugin Details

Severity: High

ID: 400812

Version: Revision 1.22

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 1/17/2024

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-14164

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/21/2017

Vulnerability Publication Date: 8/16/2017

Reference Information

CVE: CVE-2017-14039, CVE-2017-14040, CVE-2017-14041, CVE-2017-14151, CVE-2017-14152, CVE-2017-14164

BID: 100550, 100553, 100555, 100633, 100635, 100677

Detections

Analytics