CVE-2018-20847

Published: 26 June 2019

An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.

From the Ubuntu Security Team

It was discovered that OpenJPEG did not properly handle certain input. If OpenJPEG were supplied with specially crafted input, it could be made to crash or potentially execute arbitrary code.

Notes

Marking emscripten ignored as openjpeg2 code is only for test/example.

it seems like commit c58df149900 (for version 2.3.1) is very similar to
commit 2d24b6000d (for version 2.1.1). This second commit is also the
fix for CVE-2015-1239, which means these issues are both solved by,
very similar commits, however, the changes seem to be applied to

different functions in each commit.

5d00b719 (2015-01-15), 2d24b60 (2015-02-02), and c58df14 (2018-11-28)

The latter regressed CVE-2018-20846, see PR 1168

Status

Severity score breakdown

References

• https://github.com/uclouvain/openjpeg/commit/5d00b719f4b93b1445e6fb4c766b9a9883c57949
• https://github.com/uclouvain/openjpeg/issues/431
• https://github.com/uclouvain/openjpeg/pull/1168/commits/c58df149900df862806d0e892859b41115875845
• https://lists.debian.org/debian-lts-announce/2019/07/msg00010.html
• https://ubuntu.com/security/notices/USN-4497-1
• https://www.cve.org/CVERecord?id=CVE-2018-20847
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931294