Buffer Overflow Vulnerability in OpenJPEG Affecting UCLouvain
CVE-2018-7648

9.8CRITICAL

Key Information:

Vendor

Uclouvain

Status
Openjpeg
Vendor
CVE Published:
2 March 2018

What is CVE-2018-7648?

A buffer overflow vulnerability exists in OpenJPEG due to inadequate validation of the output prefix length in mj2/opj_mj2_extract.c. Specifically, when a command-line prefix of 50 or more characters is provided, the system does not properly check the length of the output prefix, leading to a potential overflow. This vulnerability may allow attackers to exploit the software, resulting in unauthorized access or execution of arbitrary code. Users are advised to update to the latest version to mitigate this risk.

References

https://github.com/uclouvain/openjpeg/issues/1088
x_refsource_MISC
https://github.com/uclouvain/openjpeg/commit/cc3824767bde...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.