CVE-2017-14164: uclouvain openjpeg

Vulnerability summary

CVE-2017-14164 is a high (CVSS 8.8) vulnerability in uclouvain openjpeg. EPSS estimates a 5.44% chance of exploitation in the next 30 days, higher than 92.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 06-09-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.