SUSE-SU-2022:1296-1

    Dashboard / Vulnerabilities / SUSE-SU-2022:1296-1

    SUSE-SU-2022:1296-1

    Published: 21 Apr 2022Last Modified: 4 Feb 2026

    Summary: Security update for openjpeg

    Details: This update for openjpeg fixes the following issues: - CVE-2018-14423: Fixed division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl,and pi_next_rpcl in lib/openjp3d/pi.c (bsc#1102016). - CVE-2018-16376: Fixed heap-based buffer overflow function t2_encode_packet in lib/openmj2/t2.c (bsc#1106881). - CVE-2020-8112: Fixed a heap buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c (bsc#1162090). - CVE-2020-15389: Fixed a use-after-free if a mix of valid and invalid files in a directory operated on by the decompressor (bsc#1173578). - CVE-2020-27823: Fixed a heap buffer over-write in opj_tcd_dc_level_shift_encode() (bsc#1180457), - CVE-2021-29338: Fixed an integer Overflow allows remote attackers to crash the application (bsc#1184774).

    References: https://www.suse.com/support/update/announcement/2022/suse-su-20221296-1/, https://bugzilla.suse.com/1102016, https://bugzilla.suse.com/1106881, https://bugzilla.suse.com/1162090, https://bugzilla.suse.com/1173578, https://bugzilla.suse.com/1180457, https://bugzilla.suse.com/1184774, https://www.suse.com/security/cve/CVE-2018-14423, https://www.suse.com/security/cve/CVE-2018-16376, https://www.suse.com/security/cve/CVE-2020-15389, https://www.suse.com/security/cve/CVE-2020-27823, https://www.suse.com/security/cve/CVE-2020-8112, https://www.suse.com/security/cve/CVE-2021-29338

    Affected packages

    Package

    Name: openjpeg

    Purl: pkg:rpm/suse/openjpeg&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP3

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.5.2-150000.4.5.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2022:1296-1 | CVE-DB