Description
There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a openjpeg
openjpeg 2.4.0affected
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1907510 ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/ ↗
- https://security.gentoo.org/glsa/202101-29 ↗
- https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html ↗
- https://www.debian.org/security/2021/dsa-4882 ↗
- https://www.oracle.com/security-alerts/cpuApr2021.html ↗
- https://www.oracle.com//security-alerts/cpujul2021.html ↗