SUSE update for openjpeg2

1) Buffer overflow

EUVDB-ID: #VU63444

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-1924

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial-of-service attack.

The vulnerability exists due to a boundary error in the opj_tgt_reset function. A remote attacker can create a specially crafted JPEG 2000 image, trick the victim into opening it, trigger memory corruption and perform a denial-of-service attack.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU63445

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-3183

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the sycc422_t_rgb() function in common/color.c. A remote attacker can create a specially crafted JPEG 2000 image, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU39743

Risk: Medium

CVSSv3.1: 4.8 [AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-4797

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (application crash) via a crafted jp2 file.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Divide-by-zero

EUVDB-ID: #VU13982

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14423

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to multiple division-by-zero conditions that exist in the pi_next_pcrl, pi_next_cprl, and pi_next_rpcl functions, as defined in the lib/openjp3d/pi.c source code file. A remote attacker can trick the victim into opening a specially crafted file with an application that uses the affected library and cause the affected application to crash.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU36741

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-16375

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in OpenJPEG 2.3.0. Missing checks for header_info.height and header_info.width in the function pnmtoimage in bin/jpwl/convert.c can lead to a heap-based buffer overflow.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds write

EUVDB-ID: #VU36742

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-16376

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Division by zero

EUVDB-ID: #VU63447

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20845

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error in the functions pi_next_pcrl(), pi_next_cprl(), and pi_next_rpcl() in openmj2/pi.c. A remote attacker can create a specially crafted file, trick the victim into opening it and cause a denial of service.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Input validation error

EUVDB-ID: #VU63448

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20846

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the functions pi_next_lrcp(), pi_next_rlcp(), pi_next_rpcl(), pi_next_pcrl(), pi_next_rpcl(), and pi_next_cprl() in openmj2/pi.c. A remote attacker can trick the victim to open a specially crafted file and perform a denial of service (DoS) attack.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Use-after-free

EUVDB-ID: #VU34190

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-15389

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Heap-based buffer overflow

EUVDB-ID: #VU48907

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-27823

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PNG images in pngtoimage() function in bin/jp2/convertpng.c. A remote attacker can pass specially crafted file to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Heap-based buffer overflow

EUVDB-ID: #VU25546

Risk: Medium

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-8112

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the the qmfbid==1 case, a different issue than CVE-2020-6851. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Integer overflow

EUVDB-ID: #VU63449

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-29338

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer overflow when using the command line option "-ImgDir" on a directory that contains 1048576 files. A remote attacker can pass specially crafted data to the application, trigger integer overflow and perform a denial of service attack.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Access of Uninitialized Pointer

EUVDB-ID: #VU63450

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1122

CWE-ID: CWE-824 - Access of Uninitialized Pointer

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to an invalid pointer initialization in the opj2_decompress program. A remote attacker can gain unauthorized access to sensitive information and perform a denial of service attack.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE OpenStack Cloud Crowbar: 8 - 9

SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4

HPE Helion Openstack: 8

SUSE Linux Enterprise Server: 12-SP2-BCL - 12-SP5

SUSE OpenStack Cloud: 8 - 9

openjpeg2-debugsource: before 2.1.0-4.15.1

openjpeg2-debuginfo: before 2.1.0-4.15.1

libopenjp2-7-debuginfo: before 2.1.0-4.15.1

libopenjp2-7: before 2.1.0-4.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.