{"id":"CVE-2018-21010","aliases":["ALPINE-CVE-2018-21010","DEBIAN-CVE-2018-21010","DLA-1950-1","EUVD-2018-13534","GHSA-352f-66f5-76w2","SUSE-SU-2022:3801-1","SUSE-SU-2022:3802-1","SUSE-SU-2022:4082-1","UBUNTU-CVE-2018-21010","USN-4497-1","openSUSE-SU-2024:13571-1"],"status":"published","title":"OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.","description":"OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02091,"percentile":0.81755,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-787"],"published":"2019-09-05T12:52:29Z","modified":"2026-10-23T18:03:05Z","fixes":[{"ecosystem":"Alpine:v3.8","package":"openjpeg","fixed_in":["2.3.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"openjpeg","fixed_in":["2.3.0-r4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"openjpeg2","fixed_in":["2.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openjpeg2","fixed_in":["2.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openjpeg2","fixed_in":["2.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"openjpeg2","fixed_in":["2.1.0-2+deb8u8"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"openjpeg2","fixed_in":["2.1.2-1.1+deb9u5build0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.8","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-r4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-2+deb8u8"}]}],"versions":["2.1.0-2","2.1.0-2+deb8u1","2.1.0-2+deb8u2","2.1.0-2+deb8u3","2.1.0-2+deb8u4","2.1.0-2+deb8u5","2.1.0-2+deb8u6","2.1.0-2+deb8u7"]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.18.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.18.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.18.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.18.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.18.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.18.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.18.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.18.2"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-150000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.2-150000.4.10.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3+dfsg-4.6ubuntu2","1.3+dfsg-4.7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1.1+deb9u5build0.16.04.1"}]}],"versions":["2.1.0-2.1","2.1.0-2.1ubuntu0.1","2.1.2-1.1+deb9u2build0.1","2.1.2-1.1+deb9u3build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"blender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.74+dfsg0-4build2","2.75.a+dfsg0-2ubuntu2","2.75.a+dfsg0-2ubuntu3","2.76.b+dfsg0-3","2.76.b+dfsg0-3build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openjpeg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.5.2-3.1","1:1.5.2-3.1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-1","4.4.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"blender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.78.c+dfsg0-2build1","2.79+dfsg0-2build1","2.79+dfsg0-3","2.79+dfsg0-3build1","2.79.b+dfsg0-1","2.79.b+dfsg0-1ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.9.1+dfsg-4","5.9.1+dfsg-4ubuntu1","5.9.2+dfsg-2ubuntu1","5.9.3+dfsg-0ubuntu1","5.9.4+dfsg-0ubuntu1","5.9.5+dfsg-0ubuntu2","5.9.5+dfsg-0ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5-1","5.0.2-1","5.0.2-1build1","5.0.2-1build2","5.0.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"blender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.80+dfsg-3","2.80+dfsg-3build1","2.80+dfsg-4","2.81.a+dfsg-5build3","2.82+dfsg-1","2.82+dfsg-1build1","2.82.a+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-4.1ubuntu1","4.13.2-dfsg1-1ubuntu1","4.13.2-dfsg1-4ubuntu1","4.13.2-dfsg1-6","4.13.2-dfsg1-6ubuntu1","4.13.2-dfsg1-8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.12.4+dfsg-1ubuntu1","5.12.4+dfsg-1ubuntu3","5.12.5+dfsg-3ubuntu1","5.12.5+dfsg-6ubuntu2","5.12.5+dfsg-7","5.12.5+dfsg-7build1","5.12.8+dfsg-0ubuntu1","5.12.8+dfsg-0ubuntu1.1","5.12.8+dfsg-0ubuntu1.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.3-1build2","5.0.3-1build3","5.0.3-1build4","5.0.3-1build5","5.0.3-1ubuntu0.20.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"blender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.93.3+dfsg-3","2.93.5+dfsg-1","2.93.5+dfsg-1build1","3.0.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.3withdata-dfsg1-4.1","4.13.3withdata-dfsg2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.6+dfsg-1","5.15.6+dfsg-2","5.15.7+dfsg-2","5.15.8+dfsg-1","5.15.8+dfsg-1build1","5.15.8+dfsg-1build2","5.15.8+dfsg-2","5.15.9+dfsg-1","5.15.9+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.3-1build8","5.0.3-1build9","5.0.3-1ubuntu0.22.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"blender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2+dfsg-2ubuntu1","3.6.2+dfsg-2ubuntu2","4.0.2+dfsg-1ubuntu1","4.0.2+dfsg-1ubuntu2","4.0.2+dfsg-1ubuntu4","4.0.2+dfsg-1ubuntu6","4.0.2+dfsg-1ubuntu7","4.0.2+dfsg-1ubuntu8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.15+dfsg-2","5.15.15+dfsg-2build2","5.15.15+dfsg-2ubuntu1","5.15.16+dfsg-1","5.15.16+dfsg-1ubuntu2","5.15.16+dfsg-1ubuntu4","5.15.16+dfsg-3","5.15.16+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.3+dfsg-1build4","5.1.3+dfsg-1build5","5.1.3+dfsg-1build6","5.1.3+dfsg-1build7","5.1.3+dfsg-1build8","5.1.3+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"blender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.2+dfsg-2","4.3.2+dfsg-2ubuntu1","4.3.2+dfsg-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.18+dfsg-2","5.15.18+dfsg-2build1","5.15.19+dfsg-1","5.15.19+dfsg2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.3+dfsg-3","5.1.3+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"blender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.1+dfsg-1ubuntu1","5.0.1+dfsg-1ubuntu3","5.0.1+dfsg-3build1","5.0.1+dfsg-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-4","5.15.19+dfsg2-6","5.15.19+dfsg2-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.1+dfsg-3build1","6.0.1+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"blender","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.2+dfsg-2ubuntu2","5.0.1+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"texmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.1.3+dfsg-3build1","6.0.1+dfsg-3","6.0.1+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"qtwebengine-opensource-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.19+dfsg2-1","5.15.19+dfsg2-1build1","5.15.19+dfsg2-2","5.15.19+dfsg2-3","5.15.19+dfsg2-4","5.15.19+dfsg2-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1.1+deb9u5build0.16.04.1"}]}],"versions":["2.1.0-2.1","2.1.0-2.1ubuntu0.1","2.1.2-1.1+deb9u2build0.1","2.1.2-1.1+deb9u3build0.16.04.1"],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"uclouvain","product":"openjpeg"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202101-29","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/uclouvain/openjpeg/commit/2e5ab1d9987831c981ff05862e8ccf1381ed58ea","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-21010"},{"url":"https://github.com/advisories/GHSA-352f-66f5-76w2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-21010","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-21010","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223801-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149789","tags":["report"]},{"url":"https://bugzilla.suse.com/1179821","tags":["report"]},{"url":"https://bugzilla.suse.com/1180043","tags":["report"]},{"url":"https://bugzilla.suse.com/1180044","tags":["report"]},{"url":"https://bugzilla.suse.com/1180046","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-21010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27845","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223802-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1140205","tags":["report"]},{"url":"https://bugzilla.suse.com/1179594","tags":["report"]},{"url":"https://bugzilla.suse.com/1180042","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27841","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224082-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-21010","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4497-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-21010","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12973","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-6851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-8112","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15389","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1122","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-21010","description":"OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.","status":"published","published":"2019-09-05T12:52:29Z","modified":"2024-08-05T12:19:27.479Z","updated_at":"2026-11-02T14:35:02.289647Z"}],"euvd":[{"id":"EUVD-2018-13534","description":"OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.","status":"published","published":"2019-09-05T12:52:29Z","modified":"2024-08-05T12:19:27Z","updated_at":"2026-11-03T02:39:28.765449Z"}],"ghsa":[{"id":"GHSA-352f-66f5-76w2","title":"OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.","description":"OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.","status":"published","published":"2022-05-24T16:55:29Z","modified":"2023-01-30T05:00:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:46:16.829694Z"}],"nvd":[{"id":"CVE-2018-21010","description":"OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.","status":"published","published":"2019-09-05T13:15:10.813Z","modified":"2026-06-17T01:53:56.993Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:59.278647Z"}],"osv":[{"id":"ALPINE-CVE-2018-21010","description":"OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.","status":"published","published":"2019-09-05T13:15:10.813Z","modified":"2026-10-23T17:24:40.635143684Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"CVE-2018-21010","description":"OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.","status":"published","published":"2019-09-05T13:15:10.813Z","modified":"2026-10-20T13:21:50.699109334Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-21010","description":"OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.","status":"published","published":"2019-09-05T13:15:10.813Z","modified":"2026-10-23T18:03:05.788332254Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"UBUNTU-CVE-2018-21010","description":"OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.","status":"published","published":"2019-09-05T13:15:00Z","modified":"2026-10-17T12:55:00.168311992Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"DLA-1950-1","title":"openjpeg2 - security update","status":"published","published":"2019-10-08T00:00:00Z","modified":"2026-03-09T01:20:30.929213Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"openSUSE-SU-2024:13571-1","title":"libopenjp2-7-2.5.0-4.1 on GA media","description":"These are all security issues fixed in the libopenjp2-7-2.5.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:42.127645Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2022:3801-1","title":"Security update for openjpeg2","description":"This update for openjpeg2 fixes the following issues:\n\n  - CVE-2018-21010: Fixed heap buffer overflow in color_apply_icc_profile in bin/common/color.c (bsc#1149789).\n  - CVE-2020-27824: Fixed OOB read in opj_dwt_calc_explicit_stepsizes() (bsc#1179821).\n  - CVE-2020-27842: Fixed null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c (bsc#1180043).\n  - CVE-2020-27843: Fixed out-of-bounds read in opj_t2_encode_packet function in openjp2/t2.c (bsc#1180044).\n  - CVE-2020-27845: Fixed heap-based buffer over-read in functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in openjp2/pi.c (bsc#1180046).\n","status":"published","published":"2022-10-27T14:24:21Z","modified":"2026-02-04T02:51:43.294503Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3802-1","title":"Security update for openjpeg2","description":"This update for openjpeg2 fixes the following issues:\n\n  - CVE-2018-20846: Fixed OOB read in pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c (bsc#1140205).\n  - CVE-2018-21010: Fixed heap buffer overflow in color_apply_icc_profile in bin/common/color.c (bsc#1149789).\n  - CVE-2020-27814: Fixed heap buffer overflow in lib/openjp2/mqc.c (bsc#1179594),\n  - CVE-2020-27824: Fixed OOB read in opj_dwt_calc_explicit_stepsizes() (bsc#1179821).\n  - CVE-2020-27841: Fixed buffer over-read in lib/openjp2/pi.c (bsc#1180042).\n  - CVE-2020-27842: Fixed null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c (bsc#1180043).\n  - CVE-2020-27843: Fixed OOB read in opj_t2_encode_packet function in openjp2/t2.c (bsc#1180044).\n  - CVE-2020-27845: Fixed heap-based buffer over-read in functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in openjp2/pi.c (bsc#1180046).\n","status":"published","published":"2022-10-27T14:27:02Z","modified":"2026-02-04T04:02:03.325959Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4082-1","title":"Security update for openjpeg","description":"This update for openjpeg fixes the following issues:\n\n-  CVE-2018-20846: Fixed an Out-of-bounds accesses in pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.  (bsc#1140205)\n-  CVE-2018-21010: Fixed a heap buffer overflow in color_apply_icc_profile in bin/common/color.c  (bsc#1149789)\n-  CVE-2020-27824: Fixed an OOB read in opj_dwt_calc_explicit_stepsizes() (bsc#1179821)\n-  CVE-2020-27842: Fixed null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c (bsc#1180043)\n-  CVE-2020-27843: Fixed an out-of-bounds read in opj_t2_encode_packet function in openjp2/t2.c (bsc#1180044)\n-  CVE-2020-27845: Fixed a heap-based buffer over-read in functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in openjp2/pi.c (bsc#1180046)\n","status":"published","published":"2022-11-18T14:44:55Z","modified":"2026-02-04T03:05:22.669102Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-4497-1","title":"OpenJPEG vulnerabilities","description":"It was discovered that OpenJPEG incorrectly handled certain image files. A\nremote attacker could possibly use this issue to cause a denial of service.\n(CVE-2016-9112)\n\nIt was discovered that OpenJPEG did not properly handle certain input. If\nOpenJPEG were supplied with specially crafted input, it could be made to crash\nor potentially execute arbitrary code.\n(CVE-2018-20847, CVE-2018-21010, CVE-2020-6851, CVE-2020-8112, CVE-2020-15389)\n\nIt was discovered that OpenJPEG incorrectly handled certain BMP files. A\nremote attacker could possibly use this issue to cause a denial of service.\n(CVE-2019-12973)\n","status":"published","published":"2020-09-15T18:30:32Z","modified":"2026-04-27T15:48:43.990997371Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}