CVE-2018-5785 — Integer Overflow or Wraparound in Openjpeg

CWE-190 — Integer Overflow or Wraparound14 documents8 sources
Severity
6.5MEDIUMNVD
EPSS
0.7%
top 28.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
THE Openjpeg Project Openjpeg2Canonical Ubuntu LinuxDebian Linux+1 more
Timeline
PublishedJan 19
Latest updateMay 13

Description

In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶Debianthe_openjpeg_project/openjpeg2< 2.3.0-2+3

Also affects: Debian Linux 9.0, Ubuntu Linux 18.04

🔴Vulnerability Details

5
GHSA
GHSA-7pgc-fq24-w5rr: In OpenJPEG 2↗2022-05-13
▶
OSV
openjpeg2 vulnerabilities↗2019-08-21
▶
OSV
thunderbird vulnerabilities↗2019-02-26
▶
CVEList
CVE-2018-5785: In OpenJPEG 2↗2018-01-19
▶
OSV
CVE-2018-5785: In OpenJPEG 2↗2018-01-19
▶

📋Vendor Advisories

3
Ubuntu
OpenJPEG vulnerabilities↗2019-08-21
▶
Red Hat
openjpeg: integer overflow in opj_j2k_setup_encoder function in openjp2/j2k.c↗2018-01-19
▶
Debian
CVE-2018-5785: openjpeg2 - In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left ...↗2018
▶

💬Community

5
Bugzilla
CVE-2018-5785 openjpeg: integer overflow in opj_j2k_setup_encoder function in openjp2/j2k.c [fedora-all]↗2018-01-23
▶
Bugzilla
CVE-2018-5785 openjpeg: integer overflow in opj_j2k_setup_encoder function in openjp2/j2k.c [epel-all]↗2018-01-23
▶
Bugzilla
CVE-2018-5785 openjpeg2: openjpeg: integer overflow in opj_j2k_setup_encoder function in openjp2/j2k.c [fedora-all]↗2018-01-23
▶
Bugzilla
CVE-2018-5785 mingw-openjpeg2: openjpeg: integer overflow in opj_j2k_setup_encoder function in openjp2/j2k.c [fedora-all]↗2018-01-23
▶
Bugzilla
CVE-2018-5785 openjpeg: integer overflow in opj_j2k_setup_encoder function in openjp2/j2k.c↗2018-01-23
▶
CVE-2018-5785 — Integer Overflow or Wraparound | cvebase