MGASA-2021-0216

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2021-29338
Published: 21 May 2021, 22:47
Last modified:16 Apr 2026, 04:25

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

21 May 2021, 22:47
Published
Vulnerability first disclosed
16 Apr 2026, 04:25
Last Modified
Vulnerability information updated

Description

Updated openjpeg2 packages fix a security vulnerability There is a flaw in the opj2_compress program in openjpeg2. An attacker who is able to submit a large number of image files to be processed in a directory by opj2_compress, could trigger a heap out-of-bounds write due to an integer overflow, which is caused by the large number of image files. The greatest threat posed by this flaw is to confidentiality, integrity, and availability. This flaw affects the opj2_compress utility but is not in the openjpeg2 library. Therefore, the attack vector is local to the opj2_compress utility and would require an attacker to convince a user to open a directory with an extremely large number of files using opj2_compress, or a script to be feeding such arbitrary, untrusted files to opj2_compress (CVE-2021-29338).

Affected Systems

  • mageia•mingw-openjpeg2

    < 2.4.0-1.mga7

  • mageia•openjpeg2

    < 2.4.0-1.1.mga7

  • mageia•mingw-openjpeg2

    < 2.4.0-1.1.mga8

  • mageia•openjpeg2

    < 2.4.0-1.1.mga8

References (5)