CVE-2018-20847

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2018-20847
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-20847.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2018-20847
Downstream
Related
Published
2019-06-26T18:15:10Z
Modified
2025-08-09T20:01:28Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An improper computation of ptx0, ptx1, pty0 and pty1 in the function opjgetencoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.

References

Affected packages

Debian:11 / openjpeg2

Package

Name
openjpeg2
Purl
pkg:deb/debian/openjpeg2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3.1-1

Ecosystem specific 

{
    "urgency": "low"
}

Debian:12 / openjpeg2

Package

Name
openjpeg2
Purl
pkg:deb/debian/openjpeg2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3.1-1

Ecosystem specific 

{
    "urgency": "low"
}

Debian:13 / openjpeg2

Package

Name
openjpeg2
Purl
pkg:deb/debian/openjpeg2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3.1-1

Ecosystem specific 

{
    "urgency": "low"
}

Debian:14 / openjpeg2

Package

Name
openjpeg2
Purl
pkg:deb/debian/openjpeg2?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3.1-1

Ecosystem specific 

{
    "urgency": "low"
}

Git / github.com/uclouvain/openjpeg

Affected ranges

Type
GIT
Repo
https://github.com/uclouvain/openjpeg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5d00b719f4b93b1445e6fb4c766b9a9883c57949

Database specific 

{
    "vanir_signatures": [
        {
            "id": "CVE-2018-20847-09c54e44",
            "deprecated": false,
            "signature_version": "v1",
            "source": "https://github.com/uclouvain/openjpeg/commit/5d00b719f4b93b1445e6fb4c766b9a9883c57949",
            "signature_type": "Function",
            "digest": {
                "function_hash": "163378792543775124696387571498731229941",
                "length": 2597.0
            },
            "target": {
                "function": "opj_get_all_encoding_parameters",
                "file": "src/lib/openjp2/pi.c"
            }
        },
        {
            "id": "CVE-2018-20847-5143d364",
            "deprecated": false,
            "signature_version": "v1",
            "source": "https://github.com/uclouvain/openjpeg/commit/5d00b719f4b93b1445e6fb4c766b9a9883c57949",
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "15260350836644213240829099315201793762",
                    "173443813093649578680407006076703983292",
                    "54709661076326201330083866866759711426",
                    "121713522297824452935289107708446190463",
                    "165168505138123589767261992393647519663",
                    "46878580236153829076650875780653926826",
                    "102017304529906639766385571652773303262"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "src/lib/openjp2/tcd.c"
            }
        },
        {
            "id": "CVE-2018-20847-659b2ffd",
            "deprecated": false,
            "signature_version": "v1",
            "source": "https://github.com/uclouvain/openjpeg/commit/5d00b719f4b93b1445e6fb4c766b9a9883c57949",
            "signature_type": "Line",
            "digest": {
                "line_hashes": [
                    "176615525002015676482656684392522200543",
                    "43405247619569204100702115459277374226",
                    "117451511473347492792874953304723327335",
                    "318359758975478787308868838886806726441",
                    "100905172399819142807590137543089589464",
                    "327286993796517583159493696502807280184",
                    "264804895149057228764343549705254440814"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "src/lib/openjp2/pi.c"
            }
        },
        {
            "id": "CVE-2018-20847-7bd4fd58",
            "deprecated": false,
            "signature_version": "v1",
            "source": "https://github.com/uclouvain/openjpeg/commit/5d00b719f4b93b1445e6fb4c766b9a9883c57949",
            "signature_type": "Function",
            "digest": {
                "function_hash": "170610748971508839838692560277608944310",
                "length": 9025.0
            },
            "target": {
                "function": "opj_tcd_init_tile",
                "file": "src/lib/openjp2/tcd.c"
            }
        }
    ]
}