openjpeg2 (SUSE:Linux Enterprise Server 15 SP2-BCL) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server 15 SP2-BCL package openjpeg2, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (21)

• CVE-2018-16375 — CVSS 8.8 (high): An issue was discovered in OpenJPEG 2.3.0. Missing checks for header_info.height and header_info.width in the function pnmtoimage in…
• CVE-2018-16376 — CVSS 8.8 (high): An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in…
• CVE-2020-8112 — CVSS 8.8 (high): opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a…
• CVE-2018-21010 — CVSS 8.8 (high): OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.
• CVE-2020-27814 — CVSS 7.8 (high): A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an…
• CVE-2020-27823 — CVSS 7.8 (high): A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during…
• CVE-2018-14423 — CVSS 7.5 (high): Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through…
• CVE-2020-6851 — CVSS 7.5 (high): OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of…
• CVE-2018-5727 — CVSS 6.5 (medium): In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could…
• CVE-2018-20846 — CVSS 6.5 (medium): Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in…
• CVE-2018-20845 — CVSS 6.5 (medium): Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0…
• CVE-2020-15389 — CVSS 6.5 (medium): jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a…
• CVE-2018-5785 — CVSS 6.5 (medium): In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function…
• CVE-2020-27845 — CVSS 5.5 (medium): There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to…
• CVE-2022-1122 — CVSS 5.5 (medium): A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files…
• CVE-2021-29338 — CVSS 5.5 (medium): Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when…
• CVE-2020-27842 — CVSS 5.5 (medium): There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by…
• CVE-2020-27824 — CVSS 5.5 (medium): A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply…
• CVE-2020-27841 — CVSS 5.5 (medium): There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be…
• CVE-2018-6616 — CVSS 5.5 (medium): In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this…
• CVE-2020-27843 — CVSS 5.5 (medium): A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion…