CVE-2017-14152: A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write…

high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c and opj_j2k_write_sot in lib/openjp2/j2k.c) or possibly remote code execution.

Affected

31 ranges· showing 25

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	debian_linux	—	—
debian	openjpeg2	< openjpeg2 2.3.0-1 (bookworm)	openjpeg2 2.3.0-1 (bookworm)
debian	openjpeg2	—	—
the_openjpeg_project	openjpeg2	>= 0 < 2.3.0-1	2.3.0-1
the_openjpeg_project	openjpeg2	>= 0 < 2.3.0-1	2.3.0-1
the_openjpeg_project	openjpeg2	>= 0 < 2.3.0-1	2.3.0-1
the_openjpeg_project	openjpeg2	>= 0 < 2.3.0-1	2.3.0-1
uclouvain	openjpeg	< 2.3.0	2.3.0
uclouvain	openjpeg	—	—
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r2	2.2.0-r2
uclouvain	openjpeg	>= 0 < 2.2.0-r0	2.2.0-r0

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

osv8.8HIGH