CVE-2014-0158

High

Description

Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file because of incorrect j2k_decode, j2k_read_eoc, and tcd_decode_tile interaction, a related issue to CVE-2013-6045. NOTE: this is not a duplicate of CVE-2013-1447, because the scope of CVE-2013-1447 was specifically defined in http://openwall.com/lists/oss-security/2013/12/04/6 as only "null pointer dereferences, division by zero, and anything that would just fit as DoS."

SeverityHigh

CVSS8.8

Exploit probability—

ProductUclouvain Openjpeg

PublishedApr 10, 2018

First seenApr 10, 2018

How to fix

Update

uclouvain openjpeg1.5.2 or later

Affected products

Product	Affected versions	Fixed in
uclouvain openjpeg	v < 1.5.2	1.5.2
opensuse opensuse	12.3, 13.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.