Uclouvain vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2021-3575 A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file.High 7.8 · Mar 4, 2022
• CVE-2020-27823 A flaw was found in OpenJPEG’s encoder.High 7.8 · May 13, 2021
• CVE-2020-27814 A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files.High 7.8 · Jan 26, 2021
• CVE-2020-27844 A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0.High 7.8 · Jan 5, 2021
• CVE-2020-8112 opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in the qmfbid==1 case, a different issue thanHigh 8.8 · Jan 28, 2020
• CVE-2020-6851 OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validHigh 7.5 · Jan 13, 2020
• CVE-2018-21010 OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.High 8.8 · Sep 5, 2019
• CVE-2018-20847 An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an inHigh 8.8 · Jun 26, 2019
• CVE-2018-16376 An issue was discovered in OpenJPEG 2.3.0.High 8.8 · Sep 2, 2018
• CVE-2018-16375 An issue was discovered in OpenJPEG 2.3.0.High 8.8 · Sep 2, 2018
• CVE-2018-14423 Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attacHigh 7.5 · Jul 19, 2018
• CVE-2014-0158 Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause a denial of service (application crash) High 8.8 · Apr 10, 2018
• CVE-2018-7648 An issue was discovered in mj2/opj_mj2_extract.c in OpenJPEG 2.3.0.Critical 9.8 · Mar 2, 2018
• CVE-2017-17480 In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c.Critical 9.8 · Dec 8, 2017
• CVE-2017-17479 In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c.Critical 9.8 · Dec 8, 2017
• CVE-2017-14164 A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0.High 8.8 · Sep 6, 2017
• CVE-2017-14152 A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0.High 8.8 · Sep 5, 2017
• CVE-2017-14151 An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd.c in OpenJPEG 2.2.0.High 8.8 · Sep 5, 2017
• CVE-2017-14041 A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0.High 8.8 · Aug 30, 2017
• CVE-2017-14040 An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function.High 8.8 · Aug 30, 2017
• CVE-2017-14039 A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in lib/openjp2/t2.c in OpenJPEG 2.2.0.High 8.8 · Aug 30, 2017
• CVE-2016-9675 openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045.High 7.8 · Dec 22, 2016
• CVE-2016-9114 There is a NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) of OpenJPEG 2.1.2.High 7.5 · Oct 30, 2016
• CVE-2016-9113 There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2.High 7.5 · Oct 30, 2016
• CVE-2016-9112 Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl function in openjp2/pi.c:523 in OpenJPEG 2.1.2.High 7.5 · Oct 29, 2016