CVE-2017-14151Improper Restriction of Operations within the Bounds of a Memory Buffer in Openjpeg

Severity
8.8HIGHNVD
EPSS
0.9%
top 24.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 5
Latest updateMay 13

Description

An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_mqc_flush in lib/openjp2/mqc.c and opj_t1_encode_cblk in lib/openjp2/t1.c) or possibly remote code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

Also affects: Debian Linux 8.0, 9.0

Patches

🔴Vulnerability Details

3
GHSA
GHSA-w8c7-459j-36p9: An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd2022-05-13
OSV
CVE-2017-14151: An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd2017-09-05
CVEList
CVE-2017-14151: An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd2017-09-05

📋Vendor Advisories

2
Red Hat
openjpeg: Heap-based buffer overflow in opj_mqc_flush in mqc.c2017-08-20
Debian
CVE-2017-14151: openjpeg2 - An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in li...2017

💬Community

6
Bugzilla
CVE-2017-14151 CVE-2017-14152 openjpeg2: various flaws [fedora-all]2017-08-31
Bugzilla
CVE-2017-14151 openjpeg: Heap-based buffer overflow in opj_mqc_flush in mqc.c2017-08-31
Bugzilla
CVE-2017-14151 CVE-2017-14152 openjpeg: various flaws [fedora-all]2017-08-31
Bugzilla
CVE-2017-14151 CVE-2017-14152 openjpeg2: various flaws [epel-all]2017-08-31
Bugzilla
CVE-2017-14151 CVE-2017-14152 mingw-openjpeg2: various flaws [fedora-all]2017-08-31
CVE-2017-14151 — Uclouvain Openjpeg vulnerability | cvebase