https://github.com/uclouvain/openjpeg/issues/1476

https://github.com/uclouvain/openjpeg/pull/1470

https://github.com/uclouvain/openjpeg/pull/1471

{"timestamp":"2024-07-09T14:08:00.356050Z","id":"CVE-2023-39328","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"collectionURL":"https://www.openjpeg.org/","packageName":"openjpeg","versions":[{"version":"2.5.0","versionType":"semver","status":"affected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openjpeg","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openjpeg","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openjpeg2","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp:flatpak/openjpeg2","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"inkscape:flatpak/openjpeg2","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"libreoffice:flatpak/openjpeg2","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openjpeg2","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openjpeg2","cpes":["cpe

AND
     OR
          *cpe:2.3:a:uclouvain:openjpeg:-:*:*:*:*:*:*:*
     OR
          cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

AND
     OR
          *cpe:2.3:a:uclouvain:openjpeg:2.0:*:*:*:*:*:*:*
     OR
          cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
          cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

OR
          *cpe:2.3:a:uclouvain:openjpeg:2.5.0:*:*:*:*:*:*:*

CVE: https://access.redhat.com/security/cve/CVE-2023-39328 Types: Third Party Advisory

CVE: https://bugzilla.redhat.com/show_bug.cgi?id=2219236 Types: Issue Tracking, Third Party Advisory

Red Hat, Inc.: https://access.redhat.com/security/cve/CVE-2023-39328 Types: Third Party Advisory

Red Hat, Inc.: https://bugzilla.redhat.com/show_bug.cgi?id=2219236 Types: Issue Tracking, Third Party Advisory

https://access.redhat.com/security/cve/CVE-2023-39328

https://bugzilla.redhat.com/show_bug.cgi?id=2219236

A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.

Red Hat, Inc. AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Red Hat, Inc. CWE-400

Red Hat, Inc. https://access.redhat.com/security/cve/CVE-2023-39328 [No types assigned]

Red Hat, Inc. https://bugzilla.redhat.com/show_bug.cgi?id=2219236 [No types assigned]