CVE-2021-29338
published 2021-04-14CVE-2021-29338: Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the…
PriorityP423medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
1.56%
72.5th percentile
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | openjpeg2 | < openjpeg2 2.4.0-4 (bookworm) | openjpeg2 2.4.0-4 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.4.0-3+deb11u1 | 2.4.0-3+deb11u1 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.4.0-4 | 2.4.0-4 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.4.0-4 | 2.4.0-4 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.4.0-4 | 2.4.0-4 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.3.1-1ubuntu4.20.04.3 | 2.3.1-1ubuntu4.20.04.3 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.4.0-6ubuntu0.2 | 2.4.0-6ubuntu0.2 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.5.0-2ubuntu0.2 | 2.5.0-2ubuntu0.2 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.1.2-1.1+deb9u6ubuntu0.1~esm6 | 2.1.2-1.1+deb9u6ubuntu0.1~esm6 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.3.0-2+deb10u2ubuntu0.1~esm3 | 2.3.0-2+deb10u2ubuntu0.1~esm3 |
| uclouvain | openjpeg | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJPEG vulnerabilities
vendor_ubuntu·2024-11-05·CVSS 5.5
CVE-2021-3575 [MEDIUM] OpenJPEG vulnerabilities
Title: OpenJPEG vulnerabilities
Summary: Several security issues were fixed in OpenJPEG.
It was discovered that OpenJPEG incorrectly handled certain memory
operations when using the command line "-ImgDir" in a directory with a
large number of files, leading to an integer overflow vulnerability. An
attacker could potentially use this issue to cause a denial of service.
This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2021-29338)
It was discovered that OpenJPEG incorrectly handled decompressing certain
.j2k files in sycc420_to_rgb, leading to a heap-based buffer overflow
vulnerability. If a user or automated system were tricked into opening
a specially crafted file, an attacker could possibly use this issue to
execute arbitrary code.
Red Hat
openjpeg: out-of-bounds write due to an integer overflow in opj_compress.c
vendor_redhat·2021-03-24·CVSS 5.5
CVE-2021-29338 [MEDIUM] CWE-190 openjpeg: out-of-bounds write due to an integer overflow in opj_compress.c
openjpeg: out-of-bounds write due to an integer overflow in opj_compress.c
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
There is a flaw in the opj2_compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2_compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The greatest threat posed by this flaw is to confidentiality, integrity, and availability.
Statement: This flaw affects the opj2_compress utility but is not in the openjpeg2 library. Therefore, t
Debian
CVE-2021-29338: openjpeg2 - Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the applica...
vendor_debian·2021·CVSS 5.5
CVE-2021-29338 [MEDIUM] CVE-2021-29338: openjpeg2 - Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the applica...
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
Scope: local
bookworm: resolved (fixed in 2.4.0-4)
bullseye: resolved (fixed in 2.4.0-3+deb11u1)
forky: resolved (fixed in 2.4.0-4)
sid: resolved (fixed in 2.4.0-4)
trixie: resolved (fixed in 2.4.0-4)
OSV
openjpeg2 vulnerabilities
osv·2024-11-05·CVSS 5.5
CVE-2021-29338 [MEDIUM] openjpeg2 vulnerabilities
openjpeg2 vulnerabilities
It was discovered that OpenJPEG incorrectly handled certain memory
operations when using the command line "-ImgDir" in a directory with a
large number of files, leading to an integer overflow vulnerability. An
attacker could potentially use this issue to cause a denial of service.
This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2021-29338)
It was discovered that OpenJPEG incorrectly handled decompressing certain
.j2k files in sycc420_to_rgb, leading to a heap-based buffer overflow
vulnerability. If a user or automated system were tricked into opening
a specially crafted file, an attacker could possibly use this issue to
execute arbitrary code. (CVE-2021-3575)
It was discovered that OpenJPEG incorrectly ha
GHSA
GHSA-q6p7-g6cv-v3pc: Integer Overflow in OpenJPEG v2
ghsa_unreviewed·2022-05-24
CVE-2021-29338 [MEDIUM] CWE-190 GHSA-q6p7-g6cv-v3pc: Integer Overflow in OpenJPEG v2
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
OSV
CVE-2021-29338: Integer Overflow in OpenJPEG v2
osv·2021-04-14·CVSS 5.5
CVE-2021-29338 [MEDIUM] CVE-2021-29338: Integer Overflow in OpenJPEG v2
Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/uclouvain/openjpeg/issues/1338https://lists.debian.org/debian-lts-announce/2022/04/msg00006.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ54FGM2IGAP4AWSJ22JKHOPHCR3FGYU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB6AI7CWXWMEDZIQY4LQ6DMIEXMDOHUP/https://security.gentoo.org/glsa/202209-04https://github.com/uclouvain/openjpeg/issues/1338https://lists.debian.org/debian-lts-announce/2022/04/msg00006.htmlhttps://lists.debian.org/debian-lts-announce/2025/04/msg00002.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ54FGM2IGAP4AWSJ22JKHOPHCR3FGYU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB6AI7CWXWMEDZIQY4LQ6DMIEXMDOHUP/https://security.gentoo.org/glsa/202209-04
2021-04-14
Published