CVE-2018-5727: Integer Overflow
A flaw was found in OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opjt1encodecblks function in openjp2/t1.c file. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
References: https://github.com/uclouvain/openjpeg/issues/1053
Other sources
In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opjt1encodecblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2018-5727.
What is the severity of CVE-2018-5727?
The severity of CVE-2018-5727 is medium.
What is the affected software for CVE-2018-5727?
The affected software for CVE-2018-5727 includes OpenJPEG 2.3.0, openjpeg2 package versions 2.4.0-3 and 2.5.0-2, ghostscript package versions 9.26~dfsg+0-0ubuntu0.18.04.14 and 9.26~dfsg+0-0ubuntu0.16.04.14, openjpeg package version 2.3.1, and openjpeg2 package versions 2.3.1, 2.3.0-2+, and 2.1.2-1.1+.
How can the vulnerability CVE-2018-5727 be exploited?
The vulnerability CVE-2018-5727 can be exploited by remote attackers using a crafted bmp file to cause a denial of service.
Are there any remedies available for CVE-2018-5727?
Yes, there are remedies available for CVE-2018-5727. For openjpeg2 package, update to version 2.4.0-3 or 2.5.0-2. For ghostscript package, update to version 9.26~dfsg+0-0ubuntu0.18.04.14 or 9.26~dfsg+0-0ubuntu0.16.04.14. For openjpeg package, update to version 2.3.1. For Uclouvain Openjpeg, update to version 2.3.0.