Your submission was sent successfully! Close

CVE-2018-21010

Published: 5 September 2019

OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.

From the Ubuntu security team

It was discovered that OpenJPEG did not properly handle certain input. If OpenJPEG were supplied with specially crafted input, it could be made to crash or potentially execute arbitrary code.

Priority

Medium

CVSS 3 base score: 8.8

Status

Package Release Status
blender
Launchpad, Ubuntu, Debian
bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needs triage

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
gdcm
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(uses system openjpeg)
disco Not vulnerable
(uses system openjpeg)
eoan Not vulnerable
(uses system openjpeg)
focal Not vulnerable
(uses system openjpeg)
groovy Not vulnerable
(uses system openjpeg)
hirsute Not vulnerable
(uses system openjpeg)
impish Not vulnerable
(uses system openjpeg)
jammy Not vulnerable
(uses system openjpeg)
precise Does not exist

trusty Not vulnerable
(uses system openjpeg)
upstream Needs triage

xenial Not vulnerable
(uses system openjpeg)
ghostscript
Launchpad, Ubuntu, Debian
bionic Not vulnerable
(code not compiled)
focal Not vulnerable
(uses system openjpeg2)
groovy Not vulnerable
(uses system openjpeg2)
hirsute Not vulnerable
(uses system openjpeg2)
impish Not vulnerable
(uses system openjpeg2)
jammy Not vulnerable
(uses system openjpeg2)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Not vulnerable
(code not compiled)
insighttoolkit4
Launchpad, Ubuntu, Debian
bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needs triage

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
openjpeg
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

groovy Does not exist

hirsute Does not exist

impish Does not exist

jammy Does not exist

precise Does not exist

trusty Needs triage

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)
openjpeg2
Launchpad, Ubuntu, Debian
bionic Needed

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Not vulnerable
(2.3.1-1)
groovy Not vulnerable
(2.3.1-1)
hirsute Not vulnerable
(2.3.1-1)
impish Not vulnerable
(2.3.1-1)
jammy Not vulnerable
(2.3.1-1)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial
Released (2.1.2-1.1+deb9u5build0.16.04.1)
Patches:
upstream: https://github.com/uclouvain/openjpeg/commit/2e5ab1d9987831c981ff05862e8ccf1381ed58ea
qtwebengine-opensource-src
Launchpad, Ubuntu, Debian
bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needs triage

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Does not exist

texmaker
Launchpad, Ubuntu, Debian
bionic Needs triage

disco Ignored
(reached end-of-life)
eoan Ignored
(reached end-of-life)
focal Needs triage

groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Needs triage

precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Ignored
(end of standard support, was needs-triage)