Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).
Weakness
The product divides a value by zero.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openjpeg | Uclouvain | * | 2.3.0 (including) |
| Openjpeg | Ubuntu | upstream | * |
| Openjpeg2 | Ubuntu | artful | * |
| Openjpeg2 | Ubuntu | bionic | * |
| Openjpeg2 | Ubuntu | cosmic | * |
| Openjpeg2 | Ubuntu | disco | * |
| Openjpeg2 | Ubuntu | esm-apps/bionic | * |
| Openjpeg2 | Ubuntu | esm-apps/xenial | * |
| Openjpeg2 | Ubuntu | upstream | * |
| Openjpeg2 | Ubuntu | xenial | * |
References
- https://github.com/uclouvain/openjpeg/issues/1123
- https://lists.debian.org/debian-lts-announce/2018/12/msg00013.html
- https://usn.ubuntu.com/4109-1/
- https://www.debian.org/security/2019/dsa-4405
- https://github.com/uclouvain/openjpeg/issues/1123
- https://lists.debian.org/debian-lts-announce/2018/12/msg00013.html
- https://usn.ubuntu.com/4109-1/
- https://www.debian.org/security/2019/dsa-4405