convert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving the variable s.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5664-1 advisory.

    It was discovered that OpenJPEG did not properly handle PNM headers, resulting in a null pointer     dereference. A remote attacker could possibly use this issue to cause a denial of service (DoS).
    (CVE-2016-7445)

    It was discovered that OpenJPEG incorrectly handled certain image files resulting in division by zero.

    A remote attacker could possibly use this issue to cause a denial of service (DoS). (CVE-2016-9112 and     CVE-2016-10506)

    It was discovered that OpenJPEG incorrectly handled converting certain image files resulting in a stack     buffer overflow. A remote attacker could possibly use this issue to cause a denial of service (DoS).
    (CVE-2017-17479)

    It was discovered that OpenJPEG incorrectly handled converting PNM image files resulting in a null pointer     dereference. A remote attacker could possibly use this issue to cause a denial of service (DoS).
    (CVE-2018-18088)

    It was discovered that OpenJPEG incorrectly handled converting DWT images files resulting in a buffer     overflow. A remote attacker could possibly use this issue to cause a denial of service (DoS).
    (CVE-2020-27824)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the openjpeg2 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - NULL pointer dereference vulnerabilities in the     imagetopnm function in convert.c, sycc444_to_rgb     function in color.c, color_esycc_to_rgb function in     color.c, and sycc422_to_rgb function in color.c in     OpenJPEG before 2.2.0 allow remote attackers to cause a     denial of service (application crash) via crafted j2k     files.(CVE-2016-10505)

  - convert.c in OpenJPEG before 2.1.2 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via vectors     involving the variable s.(CVE-2016-7445)

  - Division-by-zero vulnerabilities in the functions     pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in     lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow     remote attackers to cause a denial of service     (application crash).(CVE-2018-14423)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openjpeg package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A stack-based buffer overflow was discovered in the     pgxtoimage function in bin/jp2/convert.c in OpenJPEG     2.2.0. The vulnerability causes an out-of-bounds write,     which may lead to remote denial of service or possibly     remote code execution.(CVE-2017-14041)

  - An invalid write access was discovered in     bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash     in the tgatoimage function. The vulnerability may lead     to remote denial of service or possibly unspecified     other impact.(CVE-2017-14040)

  - convert.c in OpenJPEG before 2.1.2 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via vectors     involving the variable s.(CVE-2016-7445)

  - Heap-based buffer overflow in the JPEG2000 image tile     decoder in OpenJPEG before 1.5.2 allows remote     attackers to cause a denial of service (application     crash) or possibly have unspecified other impact via a     crafted file because of incorrect j2k_decode,     j2k_read_eoc, and tcd_decode_tile interaction, a     related issue to CVE-2013-6045. NOTE: this is not a     duplicate of CVE-2013-1447, because the scope of     CVE-2013-1447 was specifically defined in     http://openwall.com/lists/oss-security/2013/12/04/6 as     only 'null pointer dereferences, division by zero, and     anything that would just fit as DoS.'(CVE-2014-0158)

  - In OpenJPEG 2.3.0, a stack-based buffer overflow was     discovered in the pgxtoimage function in     jpwl/convert.c. The vulnerability causes an     out-of-bounds write, which may lead to remote denial of     service or possibly remote code     execution.(CVE-2017-17479)

  - NULL pointer dereference vulnerabilities in the     imagetopnm function in convert.c, sycc444_to_rgb     function in color.c, color_esycc_to_rgb function in     color.c, and sycc422_to_rgb function in color.c in     OpenJPEG before 2.2.0 allow remote attackers to cause a     denial of service (application crash) via crafted j2k     files.(CVE-2016-10505)

  - OpenJPEG 1.5.1 allows remote attackers to cause a     denial of service via unspecified vectors that trigger     NULL pointer dereferences, division-by-zero, and other     errors.(CVE-2013-6887)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openjpeg package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - NULL pointer dereference vulnerabilities in the     imagetopnm function in convert.c, sycc444_to_rgb     function in color.c, color_esycc_to_rgb function in     color.c, and sycc422_to_rgb function in color.c in     OpenJPEG before 2.2.0 allow remote attackers to cause a     denial of service (application crash) via crafted j2k     files.(CVE-2016-10505)

  - OpenJPEG 1.5.1 allows remote attackers to cause a     denial of service via unspecified vectors that trigger     NULL pointer dereferences, division-by-zero, and other     errors.(CVE-2013-6887)

  - convert.c in OpenJPEG before 2.1.2 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via vectors     involving the variable s.(CVE-2016-7445)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openjpeg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - convert.c in OpenJPEG before 2.1.2 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via vectors     involving the variable s.(CVE-2016-7445)

  - NULL pointer dereference vulnerabilities in the     imagetopnm function in convert.c, sycc444_to_rgb     function in color.c, color_esycc_to_rgb function in     color.c, and sycc422_to_rgb function in color.c in     OpenJPEG before 2.2.0 allow remote attackers to cause a     denial of service (application crash) via crafted j2k     files.(CVE-2016-10505)

  - Division-by-zero vulnerabilities in the functions     opj_pi_next_cprl, opj_pi_next_pcrl, and     opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow     remote attackers to cause a denial of service     (application crash) via crafted j2k     files.(CVE-2016-10506)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openjpeg package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - convert.c in OpenJPEG before 2.1.2 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via vectors     involving the variable s.(CVE-2016-7445)

  - NULL pointer dereference vulnerabilities in the     imagetopnm function in convert.c, sycc444_to_rgb     function in color.c, color_esycc_to_rgb function in     color.c, and sycc422_to_rgb function in color.c in     OpenJPEG before 2.2.0 allow remote attackers to cause a     denial of service (application crash) via crafted j2k     files.(CVE-2016-10505)

  - Division-by-zero vulnerabilities in the functions     opj_pi_next_cprl, opj_pi_next_pcrl, and     opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow     remote attackers to cause a denial of service     (application crash) via crafted j2k     files.(CVE-2016-10506)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openjpeg2 fixes the following issues :

  - CVE-2016-9572 CVE-2016-9573: Insuficient check in     imagetopnm() could lead to heap buffer overflow     [bsc#1014543]

  - CVE-2016-9580, CVE-2016-9581: Possible Heap buffer     overflow via integer overflow and infite loop     [bsc#1014975]

  - CVE-2016-7445: NULL pointer dereference in convert.c     could lead to crash [bsc#999817]

  - CVE-2016-8332: Malicious file in OpenJPEG JPEG2000     format could lead to code execution [bsc#1002414]

  - CVE-2016-9112: FPE(Floating Point Exception) in     lib/openjp2/pi.c:523 [bsc#1007747]

  - CVE-2016-9113: NULL point dereference in function     imagetobmp of convertbmp.c could lead to crash     [bsc#1007739]

  - CVE-2016-9114: NULL pointer Access in function     imagetopnm of convert.c:1943(jp2) could lead to crash     [bsc#1007740]

  - CVE-2016-9115: Heap Buffer Overflow in function     imagetotga of convert.c(jp2) [bsc#1007741]

  - CVE-2016-9116: NULL pointer Access in function     imagetopnm of convert.c:2226(jp2) [bsc#1007742]

  - CVE-2016-9117: NULL pointer Access in function     imagetopnm of convert.c(jp2):1289 [bsc#1007743]

  - CVE-2016-9118: Heap Buffer Overflow in function     pnmtoimage of convert.c [bsc#1007744]

This update for openjpeg2 fixes the following issues :

  - CVE-2016-9114: NULL pointer Access in function     imagetopnm of convert.c:1943(jp2) could lead to crash     [bsc#1007740]

  - CVE-2016-9115: Heap Buffer Overflow in function     imagetotga of convert.c(jp2) [bsc#1007741]

  - CVE-2016-9580, CVE-2016-9581: Possible Heap buffer     overflow via integer overflow and infite loop     [bsc#1014975]

  - CVE-2016-9117: NULL pointer Access in function     imagetopnm of convert.c(jp2):1289 [bsc#1007743]

  - CVE-2016-9118: Heap Buffer Overflow in function     pnmtoimage of convert.c [bsc#1007744] 

  - CVE-2016-9112: FPE(Floating Point Exception) in     lib/openjp2/pi.c:523 [bsc#1007747] 

  - CVE-2016-9116: NULL pointer Access in function     imagetopnm of convert.c:2226(jp2) [bsc#1007742]

  - CVE-2016-9113: NULL point dereference in function     imagetobmp of convertbmp.c could lead to crash     [bsc#1007739] 

  - CVE-2016-9572 CVE-2016-9573: Insuficient check in     imagetopnm() could lead to heap buffer overflow     [bsc#1014543]

  - CVE-2016-8332: Malicious file in OpenJPEG JPEG2000     format could lead to code execution [bsc#1002414] 

  - CVE-2016-7445: NULL pointer dereference in convert.c     could lead to crash [bsc#999817] 

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for openjpeg2 fixes the following issues :

  - CVE-2016-9114: NULL pointer Access in function     imagetopnm of convert.c:1943(jp2) could lead to crash     [bsc#1007740]

  - CVE-2016-9115: Heap Buffer Overflow in function     imagetotga of convert.c(jp2) [bsc#1007741]

  - CVE-2016-9580, CVE-2016-9581: Possible Heap buffer     overflow via integer overflow and infite loop     [bsc#1014975]

  - CVE-2016-9117: NULL pointer Access in function     imagetopnm of convert.c(jp2):1289 [bsc#1007743]

  - CVE-2016-9118: Heap Buffer Overflow in function     pnmtoimage of convert.c [bsc#1007744]

  - CVE-2016-9112: FPE(Floating Point Exception) in     lib/openjp2/pi.c:523 [bsc#1007747]

  - CVE-2016-9116: NULL pointer Access in function     imagetopnm of convert.c:2226(jp2) [bsc#1007742]

  - CVE-2016-9113: NULL point dereference in function     imagetobmp of convertbmp.c could lead to crash     [bsc#1007739]

  - CVE-2016-9572 CVE-2016-9573: Insuficient check in     imagetopnm() could lead to heap buffer overflow     [bsc#1014543]

  - CVE-2016-8332: Malicious file in OpenJPEG JPEG2000     format could lead to code execution [bsc#1002414]

  - CVE-2016-7445: NULL pointer dereference in convert.c     could lead to crash [bsc#999817]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201612-26 (OpenJPEG: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenJPEG. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted JPEG       file, possibly resulting in execution of arbitrary code or a Denial of       Service condition. Furthermore, a remote attacker may be able to obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

Update to version 2.1.2, see https://github.com/uclouvain/openjpeg/blob/v2.1.2/CHANGELOG.md for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openjpeg fixes the following issues :

  - CVE-2016-7445: Avoid a crash (NULL pointer dereference)     when convertng images. (boo#999817, CVE-2016-7445).

ID	Name	Product	Family	Severity
183615	Ubuntu 16.04 ESM : OpenJPEG vulnerabilities (USN-5664-1)	Nessus	Ubuntu Local Security Checks	critical
132803	EulerOS Virtualization for ARM 64 3.0.5.0 : openjpeg2 (EulerOS-SA-2020-1049)	Nessus	Huawei Local Security Checks	high
132174	EulerOS 2.0 SP3 : openjpeg (EulerOS-SA-2019-2639)	Nessus	Huawei Local Security Checks	critical
131656	EulerOS 2.0 SP2 : openjpeg (EulerOS-SA-2019-2503)	Nessus	Huawei Local Security Checks	high
130820	EulerOS 2.0 SP8 : openjpeg2 (EulerOS-SA-2019-2111)	Nessus	Huawei Local Security Checks	high
130819	EulerOS 2.0 SP8 : openjpeg (EulerOS-SA-2019-2110)	Nessus	Huawei Local Security Checks	high
130639	EulerOS 2.0 SP5 : openjpeg (EulerOS-SA-2019-2177)	Nessus	Huawei Local Security Checks	high
96646	openSUSE Security Update : openjpeg2 (openSUSE-2017-120)	Nessus	SuSE Local Security Checks	high
96580	openSUSE Security Update : openjpeg2 (openSUSE-2017-108)	Nessus	SuSE Local Security Checks	high
96577	openSUSE Security Update : openjpeg2 (openSUSE-2017-101)	Nessus	SuSE Local Security Checks	high
96147	SUSE SLED12 / SLES12 Security Update : openjpeg2 (SUSE-SU-2016:3270-1)	Nessus	SuSE Local Security Checks	high
95642	GLSA-201612-26 : OpenJPEG: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
94887	Fedora 25 : mingw-openjpeg2 (2016-f8235d2ef9)	Nessus	Fedora Local Security Checks	high
94772	Fedora 25 : openjpeg2 (2016-0bf602e920)	Nessus	Fedora Local Security Checks	high
93931	Fedora 23 : mingw-openjpeg2 (2016-fe55f449e0)	Nessus	Fedora Local Security Checks	high
93929	Fedora 24 : mingw-openjpeg2 (2016-c23a8ce9e5)	Nessus	Fedora Local Security Checks	high
93927	Fedora 23 : openjpeg2 (2016-ad1871cf02)	Nessus	Fedora Local Security Checks	high
93880	Fedora 24 : openjpeg2 (2016-58a8f32c86)	Nessus	Fedora Local Security Checks	high
93824	openSUSE Security Update : openjpeg (openSUSE-2016-1139)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-7445

high

Tenable Plugins

critical

high

critical

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high