cbcvebase.
CVE-2017-12982
published 2017-08-21

CVE-2017-12982: The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to…

PriorityP422medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
2.86%
85.3th percentile
The bmp_read_info_header function in bin/jp2/convertbmp.c in OpenJPEG 2.2.0 does not reject headers with a zero biBitCount, which allows remote attackers to cause a denial of service (memory allocation failure) in the opj_image_create function in lib/openjp2/image.c, related to the opj_aligned_alloc_n function in opj_malloc.c.

Affected

8 ranges
VendorProductVersion rangeFixed in
debianopenjpeg2< openjpeg2 2.3.0-1 (bookworm)openjpeg2 2.3.0-1 (bookworm)
the_openjpeg_projectopenjpeg2>= 0 < 2.3.0-12.3.0-1
the_openjpeg_projectopenjpeg2>= 0 < 2.3.0-12.3.0-1
the_openjpeg_projectopenjpeg2>= 0 < 2.3.0-12.3.0-1
the_openjpeg_projectopenjpeg2>= 0 < 2.3.0-12.3.0-1
the_openjpeg_projectopenjpeg2>= 0 < 2.1.2-1.1+deb9u6ubuntu0.1~esm12.1.2-1.1+deb9u6ubuntu0.1~esm1
the_openjpeg_projectopenjpeg2>= 0 < 2.3.0-2ubuntu0.1~esm12.3.0-2ubuntu0.1~esm1
uclouvainopenjpeg< 2.3.02.3.0

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv6.5MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.