SUSE update for openjpeg

Published: 2022-04-21

Risk	High
Patch available	YES
Number of vulnerabilities	6
CVE-ID	CVE-2018-14423 CVE-2018-16376 CVE-2020-15389 CVE-2020-27823 CVE-2020-8112 CVE-2021-29338
CWE-ID	CWE-369 CWE-787 CWE-416 CWE-122 CWE-190
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	SUSE Linux Enterprise Realtime Extension Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE Linux Enterprise Module for Desktop Applications Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system SUSE Linux Enterprise Desktop Operating systems & Components / Operating system SUSE CaaS Platform Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system openjpeg-devel-32bit Operating systems & Components / Operating system package or component libopenjpeg1-32bit-debuginfo Operating systems & Components / Operating system package or component libopenjpeg1-32bit Operating systems & Components / Operating system package or component openjpeg-devel Operating systems & Components / Operating system package or component openjpeg-debugsource Operating systems & Components / Operating system package or component openjpeg-debuginfo Operating systems & Components / Operating system package or component openjpeg Operating systems & Components / Operating system package or component libopenjpeg1-debuginfo Operating systems & Components / Operating system package or component libopenjpeg1 Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Divide-by-zero

EUVDB-ID: #VU13982

Risk: Low

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14423

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to multiple division-by-zero conditions that exist in the pi_next_pcrl, pi_next_cprl, and pi_next_rpcl functions, as defined in the lib/openjp3d/pi.c source code file. A remote attacker can trick the victim into opening a specially crafted file with an application that uses the affected library and cause the affected application to crash.

Mitigation

Update the affected package openjpeg to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Linux Enterprise Module for Desktop Applications: 15-SP3 - 15-SP4

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

openjpeg-devel-32bit: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit: before 1.5.2-150000.4.5.1

openjpeg-devel: before 1.5.2-150000.4.5.1

openjpeg-debugsource: before 1.5.2-150000.4.5.1

openjpeg-debuginfo: before 1.5.2-150000.4.5.1

openjpeg: before 1.5.2-150000.4.5.1

libopenjpeg1-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1: before 1.5.2-150000.4.5.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221296-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds write

EUVDB-ID: #VU36742

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-16376

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.

Mitigation

Update the affected package openjpeg to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Linux Enterprise Module for Desktop Applications: 15-SP3 - 15-SP4

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

openjpeg-devel-32bit: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit: before 1.5.2-150000.4.5.1

openjpeg-devel: before 1.5.2-150000.4.5.1

openjpeg-debugsource: before 1.5.2-150000.4.5.1

openjpeg-debuginfo: before 1.5.2-150000.4.5.1

openjpeg: before 1.5.2-150000.4.5.1

libopenjpeg1-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1: before 1.5.2-150000.4.5.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221296-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU34190

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-15389

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.

Mitigation

Update the affected package openjpeg to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Linux Enterprise Module for Desktop Applications: 15-SP3 - 15-SP4

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

openjpeg-devel-32bit: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit: before 1.5.2-150000.4.5.1

openjpeg-devel: before 1.5.2-150000.4.5.1

openjpeg-debugsource: before 1.5.2-150000.4.5.1

openjpeg-debuginfo: before 1.5.2-150000.4.5.1

openjpeg: before 1.5.2-150000.4.5.1

libopenjpeg1-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1: before 1.5.2-150000.4.5.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221296-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Heap-based buffer overflow

EUVDB-ID: #VU48907

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-27823

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PNG images in pngtoimage() function in bin/jp2/convertpng.c. A remote attacker can pass specially crafted file to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package openjpeg to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Linux Enterprise Module for Desktop Applications: 15-SP3 - 15-SP4

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

openjpeg-devel-32bit: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit: before 1.5.2-150000.4.5.1

openjpeg-devel: before 1.5.2-150000.4.5.1

openjpeg-debugsource: before 1.5.2-150000.4.5.1

openjpeg-debuginfo: before 1.5.2-150000.4.5.1

openjpeg: before 1.5.2-150000.4.5.1

libopenjpeg1-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1: before 1.5.2-150000.4.5.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221296-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Heap-based buffer overflow

EUVDB-ID: #VU25546

Risk: Medium

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-8112

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the the qmfbid==1 case, a different issue than CVE-2020-6851. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package openjpeg to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Linux Enterprise Module for Desktop Applications: 15-SP3 - 15-SP4

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

openjpeg-devel-32bit: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit: before 1.5.2-150000.4.5.1

openjpeg-devel: before 1.5.2-150000.4.5.1

openjpeg-debugsource: before 1.5.2-150000.4.5.1

openjpeg-debuginfo: before 1.5.2-150000.4.5.1

openjpeg: before 1.5.2-150000.4.5.1

libopenjpeg1-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1: before 1.5.2-150000.4.5.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221296-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Integer overflow

EUVDB-ID: #VU63449

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-29338

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer overflow when using the command line option "-ImgDir" on a directory that contains 1048576 files. A remote attacker can pass specially crafted data to the application, trigger integer overflow and perform a denial of service attack.

Mitigation

Update the affected package openjpeg to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Linux Enterprise Module for Desktop Applications: 15-SP3 - 15-SP4

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

openjpeg-devel-32bit: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1-32bit: before 1.5.2-150000.4.5.1

openjpeg-devel: before 1.5.2-150000.4.5.1

openjpeg-debugsource: before 1.5.2-150000.4.5.1

openjpeg-debuginfo: before 1.5.2-150000.4.5.1

openjpeg: before 1.5.2-150000.4.5.1

libopenjpeg1-debuginfo: before 1.5.2-150000.4.5.1

libopenjpeg1: before 1.5.2-150000.4.5.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221296-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.