CVE-2021-3575 — Out-of-bounds Write in Openjpeg

CWE-787 — Out-of-bounds Write8 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.3%
top 43.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
THE Openjpeg Project Openjpeg2Uclouvain OpenjpegFedoraproject Fedora+1 more
Timeline
PublishedMar 4
Latest updateNov 5

Description

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶Debianthe_openjpeg_project/openjpeg2< 2.4.0-3+deb11u1+3
▶CVEListV5uclouvain/openjpegAfeects v2.4.0 and prior.

Also affects: Fedora 33, 34, Enterprise Linux 6.0, 7.0, 8.0

🔴Vulnerability Details

4
OSV
openjpeg2 vulnerabilities↗2024-11-05
▶
GHSA
GHSA-j3vw-4g3g-wvjc: A heap-based buffer overflow was found in openjpeg in color↗2022-03-05
▶
CVEList
CVE-2021-3575: A heap-based buffer overflow was found in openjpeg in color↗2022-03-04
▶
OSV
CVE-2021-3575: A heap-based buffer overflow was found in openjpeg in color↗2022-03-04
▶

📋Vendor Advisories

3
Ubuntu
OpenJPEG vulnerabilities↗2024-11-05
▶
Red Hat
openjpeg: heap-buffer-overflow in color.c may lead to DoS or arbitrary code execution↗2021-05-01
▶
Debian
CVE-2021-3575: openjpeg2 - A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_...↗2021
▶
CVE-2021-3575 — Out-of-bounds Write in Openjpeg | cvebase