Infinite loop in OpenJPEG - CVE-2023-39327

Vulnerability identifier: #VU101965

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-39327

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop. A remote attacker can consume all available system resources and cause denial of service conditions.

OpenJPEG
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Desktop Applications Module
SUSE Package Hub 15
Basesystem Module
openSUSE Leap
Ubuntu
Fedora
libopenjp2-7 (Ubuntu package)
libopenjpip7 (Ubuntu package)
libopenjp3d7 (Ubuntu package)
libopenjpeg1-debuginfo
openjpeg-devel
libopenjpeg1
openjpeg-debuginfo
openjpeg-debugsource
openjpeg
openjpeg-devel-32bit
libopenjpeg1-32bit
libopenjpeg1-32bit-debuginfo
openjpeg2-debuginfo
libopenjp2-7
libopenjp2-7-debuginfo
openjpeg2-debugsource
libopenjp2-7-32bit
openjpeg2-devel
openjpeg2
libopenjp2-7-32bit-debuginfo
ghostscript (Ubuntu package)

Install updates from vendor's website.

OpenJPEG - update to 2.5.3
libopenjp2-7 (Ubuntu package) - addressed in versions Ubuntu Pro, 2.3.1-1ubuntu4.20.04.2, 2.4.0-6ubuntu0.1, 2.5.0-2ubuntu0.1
libopenjpip7 (Ubuntu package) - addressed in versions Ubuntu Pro, 2.3.1-1ubuntu4.20.04.2, 2.4.0-6ubuntu0.1, 2.5.0-2ubuntu0.1
libopenjp3d7 (Ubuntu package) - addressed in versions Ubuntu Pro, 2.3.1-1ubuntu4.20.04.2, 2.4.0-6ubuntu0.1
libopenjpeg1-debuginfo - update to 1.5.2-150000.4.15.1
openjpeg-devel - update to 1.5.2-150000.4.15.1
libopenjpeg1 - update to 1.5.2-150000.4.15.1
openjpeg-debuginfo - update to 1.5.2-150000.4.15.1
openjpeg-debugsource - update to 1.5.2-150000.4.15.1
openjpeg - update to 1.5.2-150000.4.15.1
openjpeg-devel-32bit - update to 1.5.2-150000.4.15.1
libopenjpeg1-32bit - update to 1.5.2-150000.4.15.1
libopenjpeg1-32bit-debuginfo - update to 1.5.2-150000.4.15.1
openjpeg2-debuginfo - addressed in versions 2.1.0-4.27.1, 2.3.0-150000.3.24.1
libopenjp2-7 - addressed in versions 2.1.0-4.27.1, 2.3.0-150000.3.24.1
libopenjp2-7-debuginfo - addressed in versions 2.1.0-4.27.1, 2.3.0-150000.3.24.1
openjpeg2-debugsource - addressed in versions 2.1.0-4.27.1, 2.3.0-150000.3.24.1
libopenjp2-7-32bit - update to 2.3.0-150000.3.24.1
openjpeg2-devel - update to 2.3.0-150000.3.24.1
openjpeg2 - update to 2.3.0-150000.3.24.1
libopenjp2-7-32bit-debuginfo - update to 2.3.0-150000.3.24.1
openjpeg - update to 2.5.2-4.fc41
ghostscript (Ubuntu package) - addressed in versions 9.26~dfsg+0-0ubuntu0.16.04.14+esm9, 9.26~dfsg+0-0ubuntu0.18.04.18+esm4, 9.50~dfsg-5ubuntu4.15+esm1, 9.55.0~dfsg1-0ubuntu5.12, 10.02.1~dfsg1-0ubuntu7.7, 10.03.1~dfsg1-0ubuntu2.4, 10.05.0dfsg1-0ubuntu1.1

• https://bugzilla.redhat.com/show_bug.cgi?id=2295812
• https://github.com/uclouvain/openjpeg/issues/1472

• Multiple vulnerabilities in OpenJPEG
• Ubuntu update for openjpeg2
• Fedora 41 update for openjpeg
• Ubuntu update for ghostscript
• SUSE update for openjpeg
• SUSE update for openjpeg2
• SUSE update for openjpeg2