CVE-2017-14039

A heap-based buffer overflow was discovered in the opjt2encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.

References

Affected packages

Git / github.com/uclouvain/openjpeg

Affected ranges

Type: GIT
Repo: https://github.com/uclouvain/openjpeg
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

c535531f03369623b9b833ef41952c62257b507e

Affected versions

v2.*

v2.2.0

Database specific

{
    "vanir_signatures": [
        {
            "source": "https://github.com/uclouvain/openjpeg/commit/c535531f03369623b9b833ef41952c62257b507e",
            "signature_type": "Line",
            "deprecated": false,
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "91843015131909262611516801983236892286",
                    "287089807267592804258651948075147523393",
                    "271147091074695616198156650530548938695",
                    "232139246865052873213394828111752795814",
                    "132407218946716406511236008697983674787",
                    "140818366234325725951162001091792728676",
                    "257713435077287072716520241305791031045",
                    "307940706585755257162283875149548706908"
                ]
            },
            "signature_version": "v1",
            "target": {
                "file": "src/lib/openjp2/t2.c"
            },
            "id": "CVE-2017-14039-2c102b92"
        },
        {
            "source": "https://github.com/uclouvain/openjpeg/commit/c535531f03369623b9b833ef41952c62257b507e",
            "signature_type": "Function",
            "deprecated": false,
            "digest": {
                "function_hash": "305364326982495910255902172214619275892",
                "length": 5107.0
            },
            "signature_version": "v1",
            "target": {
                "function": "opj_t2_encode_packet",
                "file": "src/lib/openjp2/t2.c"
            },
            "id": "CVE-2017-14039-7beeb664"
        },
        {
            "source": "https://github.com/uclouvain/openjpeg/commit/c535531f03369623b9b833ef41952c62257b507e",
            "signature_type": "Function",
            "deprecated": false,
            "digest": {
                "function_hash": "333197779534767222267329773720581898577",
                "length": 879.0
            },
            "signature_version": "v1",
            "target": {
                "function": "opj_j2k_write_sot",
                "file": "src/lib/openjp2/j2k.c"
            },
            "id": "CVE-2017-14039-934511cd"
        },
        {
            "source": "https://github.com/uclouvain/openjpeg/commit/c535531f03369623b9b833ef41952c62257b507e",
            "signature_type": "Line",
            "deprecated": false,
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "10836218539523676017936851795172491646",
                    "186323259111068633802763598633648888639",
                    "223393692161991537137424614845306178212",
                    "299371021208939660984199255457571383018",
                    "59723713253829720829761025772323854186",
                    "184991792299470983867997235842132132042",
                    "67164973024348438351225583009452067737"
                ]
            },
            "signature_version": "v1",
            "target": {
                "file": "src/lib/openjp2/j2k.c"
            },
            "id": "CVE-2017-14039-9bf28b2f"
        },
        {
            "source": "https://github.com/uclouvain/openjpeg/commit/c535531f03369623b9b833ef41952c62257b507e",
            "signature_type": "Function",
            "deprecated": false,
            "digest": {
                "function_hash": "41830172812418987381565082670664732618",
                "length": 981.0
            },
            "signature_version": "v1",
            "target": {
                "function": "opj_j2k_write_sod",
                "file": "src/lib/openjp2/j2k.c"
            },
            "id": "CVE-2017-14039-e5841632"
        }
    ]
}