CVE-2018-5727: Integer Overflow
A flaw was found in OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opjt1encodecblks function in openjp2/t1.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
References: https://github.com/uclouvain/openjpeg/issues/1053
Other sources
In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opjt1encodecblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjpeg2to a version that resolves this vulnerability.Fixed in 2.4.0-3Fixed in 2.4.0-3+deb11u1Fixed in 2.5.0-2+deb12u1Fixed in 2.5.3-2 - Upgrade
Upgrade
openjpegto a version that resolves this vulnerability.Fixed in 2.3.0 - Compensating control
Mitigate denial-of-service risk from remote attackers by limiting exposure of services that process untrusted BMP files, e.g., restrict upload/ingest and apply network controls/ACLs to reduce the ability for remote attackers to send crafted BMP files.
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-5727.
What is the severity of CVE-2018-5727?
The severity of CVE-2018-5727 is medium.
What is the affected software for CVE-2018-5727?
The affected software for CVE-2018-5727 includes OpenJPEG 2.3.0, openjpeg2 package versions 2.4.0-3 and 2.5.0-2, ghostscript package versions 9.26~dfsg+0-0ubuntu0.18.04.14 and 9.26~dfsg+0-0ubuntu0.16.04.14, openjpeg package version 2.3.1, and openjpeg2 package versions 2.3.1, 2.3.0-2+, and 2.1.2-1.1+.
How can the vulnerability CVE-2018-5727 be exploited?
The vulnerability CVE-2018-5727 can be exploited by remote attackers using a crafted bmp file to cause a denial of service.
Are there any remedies available for CVE-2018-5727?
Yes, there are remedies available for CVE-2018-5727. For openjpeg2 package, update to version 2.4.0-3 or 2.5.0-2. For ghostscript package, update to version 9.26~dfsg+0-0ubuntu0.18.04.14 or 9.26~dfsg+0-0ubuntu0.16.04.14. For openjpeg package, update to version 2.3.1. For Uclouvain Openjpeg, update to version 2.3.0.