CVE-2018-20847 Integer overflow in n/a

High 8.8 Published 26 Jun 2019 Updated 5 Aug 2024

An integer overflow in OpenJPEG's encoding parameter computation can lead to denial of service, affecting applications using the library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2018-20847?

CVE-2018-20847 is a high-severity vulnerability in Debian Debian Linux, published on 26 Jun 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.

Weakness: CWE-190

Which versions are affected by CVE-2018-20847?

It affects 2 products.

Products include Debian Debian Linux, Uclouvain Openjpeg.

How do I fix CVE-2018-20847?

Apply the vendor's patch.

Is CVE-2018-20847 being exploited?

There is no known exploitation of CVE-2018-20847 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-20847, GHSA-m375-m9p8-9949, UBUNTU-CVE-2018-20847.