SUSE-SU-2022:1129-1

    Dashboard / Vulnerabilities / SUSE-SU-2022:1129-1

    SUSE-SU-2022:1129-1

    Published: 7 Apr 2022Last Modified: 4 Feb 2026

    Summary: Security update for openjpeg2

    Details: This update for openjpeg2 fixes the following issues: - CVE-2016-1924: Fixed heap buffer overflow (bsc#980504). - CVE-2016-3183: Fixed out-of-bounds read in sycc422_to_rgb function (bsc#971617). - CVE-2016-4797: Fixed heap buffer overflow (bsc#980504). - CVE-2018-14423: Fixed division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl,and pi_next_rpcl in lib/openjp3d/pi.c (bsc#1102016). - CVE-2018-16375: Fixed missing checks for header_info.height and header_info.width in the function pnmtoimage in bin/jpwl/convert.c (bsc#1106882). - CVE-2018-16376: Fixed heap-based buffer overflow function t2_encode_packet in lib/openmj2/t2.c (bsc#1106881). - CVE-2018-20845: Fixed division-by-zero in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c (bsc#1140130). - CVE-2018-20846: Fixed out-of-bounds accesses in pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c (bsc#1140205). - CVE-2020-8112: Fixed heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c (bsc#1162090). - CVE-2020-15389: Fixed use-after-free if t a mix of valid and invalid files in a directory operated on by the decompressor (bsc#1173578). - CVE-2020-27823: Fixed heap buffer over-write in opj_tcd_dc_level_shift_encode() (bsc#1180457). - CVE-2021-29338: Fixed integer overflow that allows remote attackers to crash the application (bsc#1184774). - CVE-2022-1122: Fixed segmentation fault in opj2_decompress due to uninitialized pointer (bsc#1197738).

    References: https://www.suse.com/support/update/announcement/2022/suse-su-20221129-1/, https://bugzilla.suse.com/1102016, https://bugzilla.suse.com/1106881, https://bugzilla.suse.com/1106882, https://bugzilla.suse.com/1140130, https://bugzilla.suse.com/1140205, https://bugzilla.suse.com/1162090, https://bugzilla.suse.com/1173578, https://bugzilla.suse.com/1180457, https://bugzilla.suse.com/1184774, https://bugzilla.suse.com/1197738, https://bugzilla.suse.com/971617, https://bugzilla.suse.com/980504, https://www.suse.com/security/cve/CVE-2016-1924, https://www.suse.com/security/cve/CVE-2016-3183, https://www.suse.com/security/cve/CVE-2016-4797, https://www.suse.com/security/cve/CVE-2018-14423, https://www.suse.com/security/cve/CVE-2018-16375, https://www.suse.com/security/cve/CVE-2018-16376, https://www.suse.com/security/cve/CVE-2018-20845, https://www.suse.com/security/cve/CVE-2018-20846, https://www.suse.com/security/cve/CVE-2020-15389, https://www.suse.com/security/cve/CVE-2020-27823, https://www.suse.com/security/cve/CVE-2020-8112, https://www.suse.com/security/cve/CVE-2021-29338, https://www.suse.com/security/cve/CVE-2022-1122

    Affected packages

    Package

    Name: openjpeg2

    Purl: pkg:rpm/suse/openjpeg2&distro=HPE%20Helion%20OpenStack%208

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.1.0-4.15.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2022:1129-1 | CVE-DB