Every CVESearch/Get API key

CVE-2017-14164

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2...

8.8 HighFix available

CVE-2017-14164 is a high vulnerability (CVSS 8.8) in Uclouvain Openjpeg, published September 6, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.44%, the 92nd percentile. Fixed in openjpeg 2.2.0-r2.

What does this mean?
Severity
8.8 HighCVSS 3.1, NVD
Exploit chance
5.44%EPSS, 92nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.2.0-r2openjpeg +33 more

Description

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

5.44%Up 2.1 points since Apr 14, 2021
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openjpeg
Alpine:v3.10
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.11
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.12
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.13
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.14
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.15
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.16
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.17
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.18
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.19
before 2.2.0-r2
2.2.0-r2
Show 24 moreShow less
Affected packages
PackageAffectedFixed
openjpeg
Alpine:v3.20
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.21
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.22
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.23
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.24
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.3
before 2.2.0-r0
2.2.0-r0
openjpeg
Alpine:v3.4
before 2.2.0-r0
2.2.0-r0
openjpeg
Alpine:v3.5
before 2.2.0-r0
2.2.0-r0
openjpeg
Alpine:v3.6
before 2.2.0-r0
2.2.0-r0
openjpeg
Alpine:v3.7
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.8
before 2.2.0-r2
2.2.0-r2
openjpeg
Alpine:v3.9
before 2.2.0-r2
2.2.0-r2
openjpeg2
Mageia:5
From an advisory covering 4 CVEs
before 2.2.0-1.2.mga5
2.2.0-1.2.mga5
openjpeg2
Mageia:6
From an advisory covering 4 CVEs
before 2.2.0-1.2.mga6
2.2.0-1.2.mga6
openjpeg2
SUSE:Linux Enterprise Desktop 12 SP2
From an advisory covering 5 CVEs
before 2.1.0-4.6.1
2.1.0-4.6.1
openjpeg2
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 5 CVEs
before 2.1.0-4.6.1
2.1.0-4.6.1
openjpeg2
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
From an advisory covering 5 CVEs
before 2.1.0-4.6.1
2.1.0-4.6.1
openjpeg2
SUSE:Linux Enterprise Server 12 SP2
From an advisory covering 5 CVEs
before 2.1.0-4.6.1
2.1.0-4.6.1
openjpeg2
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 5 CVEs
before 2.1.0-4.6.1
2.1.0-4.6.1
openjpeg2
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 5 CVEs
before 2.1.0-4.6.1
2.1.0-4.6.1
openjpeg2
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 5 CVEs
before 2.1.0-4.6.1
2.1.0-4.6.1
openjpeg2
Ubuntu:16.04:LTS
before 2.1.2-1.1+deb9u2build0.1, plus listed versions
2.1.0-2.12.1.0-2.1ubuntu0.1
2.1.2-1.1+deb9u2build0.1
openjpeg2
SUSE:Package Hub 12
From an advisory covering 5 CVEs
before 2.1.0-9.1
2.1.0-9.1
openjpeg2
SUSE:Package Hub 12 SP1
From an advisory covering 5 CVEs
before 2.1.0-9.1
2.1.0-9.1

What each source reports

NVD Score used8.8

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.

Record
CVE-2017-14164
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-119, CWE-787
Updated
2026-11-02
CVE ListNo score

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.

Record
CVE-2017-14164
Updated
2026-11-02
EUVDEUVD-2017-5674No score

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.

Record
EUVD-2017-5674
Updated
2026-11-03
GitHub AdvisoriesGHSA-v5g9-wqg7-v2q88.8

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2...

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.

Record
GHSA-v5g9-wqg7-v2q8
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVALPINE-CVE-2017-141648.8

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.

Record
ALPINE-CVE-2017-14164
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2017-141648.8

CVE-2017-14164 does not affect BellSoft software

Record
BELL-CVE-2017-14164
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSV8.8

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.

Record
CVE-2017-14164
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-141648.8

A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.

Record
UBUNTU-CVE-2017-14164
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2017-0481No score

Updated openjpeg2 packages fix security vulnerability

A heap-based buffer overflow was discovered in the opj_t2_encode_packet function. The vulnerability caused an out-of-bounds write, which may have lead to remote denial of service or possibly unspecified other impact (CVE-2017-14039).

An invalid write access was discovered in bin/jp2/convert.c, triggering a crash in the tgatoimage function. The vulnerability may have lead to remote denial of service or possibly unspecified other impact (CVE-2017-14040).

A stack-based buffer overflow was discovered in the pgxtoimage function. The vulnerability caused an out-of-bounds write, which may have lead to remote denial of service or possibly remote code execution (CVE-2017-14041).

A size-validation issue was discovered in opj_j2k_write_sot. The vulnerability caused an out-of-bounds write, which may have lead to remote DoS or possibly remote code execution (CVE-2017-14164).

Record
MGASA-2017-0481
Updated
2026-11-02
OSVopenSUSE-SU-2017:2685-1No score

Security update for openjpeg2

This update for openjpeg2 fixes several issues.

These security issues were fixed:

  • CVE-2016-10507: Integer overflow vulnerability in the bmp24toimage function allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file (bsc#1056421).
  • CVE-2017-14039: A heap-based buffer overflow was discovered in the opj_t2_encode_packet function. The vulnerability caused an out-of-bounds write, which may have lead to remote denial of service or possibly unspecified other impact (bsc#1056622).
  • CVE-2017-14164: A size-validation issue was discovered in opj_j2k_write_sot. The vulnerability caused an out-of-bounds write, which may have lead to remote DoS or possibly remote code execution (bsc#1057511).
  • CVE-2017-14040: An invalid write access was discovered in bin/jp2/convert.c, triggering a crash in the tgatoimage function. The vulnerability may have lead to remote denial of service or possibly unspecified other impact (bsc#1056621).
  • CVE-2017-14041: A stack-based buffer overflow was discovered in the pgxtoimage function. The vulnerability caused an out-of-bounds write, which may have lead to remote denial of service or possibly remote code execution (bsc#1056562).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

Record
openSUSE-SU-2017:2685-1
Updated
2026-11-02
OSVopenSUSE-SU-2017:2686-1No score

Security update for openjpeg2

This update for openjpeg2 fixes several issues.

These security issues were fixed:

  • CVE-2016-10507: Integer overflow vulnerability in the bmp24toimage function allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file (bsc#1056421).
  • CVE-2017-14039: A heap-based buffer overflow was discovered in the opj_t2_encode_packet function. The vulnerability caused an out-of-bounds write, which may have lead to remote denial of service or possibly unspecified other impact (bsc#1056622).
  • CVE-2017-14164: A size-validation issue was discovered in opj_j2k_write_sot. The vulnerability caused an out-of-bounds write, which may have lead to remote DoS or possibly remote code execution (bsc#1057511).
  • CVE-2017-14040: An invalid write access was discovered in bin/jp2/convert.c, triggering a crash in the tgatoimage function. The vulnerability may have lead to remote denial of service or possibly unspecified other impact (bsc#1056621).
  • CVE-2017-14041: A stack-based buffer overflow was discovered in the pgxtoimage function. The vulnerability caused an out-of-bounds write, which may have lead to remote denial of service or possibly remote code execution (bsc#1056562).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

Record
openSUSE-SU-2017:2686-1
Updated
2026-11-02
OSVSUSE-SU-2017:2649-1No score

Security update for openjpeg2

This update for openjpeg2 fixes several issues.

These security issues were fixed:

  • CVE-2016-10507: Integer overflow vulnerability in the bmp24toimage function allowed remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted bmp file (bsc#1056421).
  • CVE-2017-14039: A heap-based buffer overflow was discovered in the opj_t2_encode_packet function. The vulnerability caused an out-of-bounds write, which may have lead to remote denial of service or possibly unspecified other impact (bsc#1056622).
  • CVE-2017-14164: A size-validation issue was discovered in opj_j2k_write_sot. The vulnerability caused an out-of-bounds write, which may have lead to remote DoS or possibly remote code execution (bsc#1057511).
  • CVE-2017-14040: An invalid write access was discovered in bin/jp2/convert.c, triggering a crash in the tgatoimage function. The vulnerability may have lead to remote denial of service or possibly unspecified other impact (bsc#1056621).
  • CVE-2017-14041: A stack-based buffer overflow was discovered in the pgxtoimage function. The vulnerability caused an out-of-bounds write, which may have lead to remote denial of service or possibly remote code execution (bsc#1056562).
Record
SUSE-SU-2017:2649-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 19 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open