USN-7223-1: OpenJPEG vulnerabilities

Publication date

22 January 2025

Overview

OpenJPEG could be made to crash or run programs if it opened a specially crafted file.


Packages

  • openjpeg2 - JPEG 2000 image compression/decompression library

Details

Frank Zeng discovered that OpenJPEG incorrectly handled memory when using
the decompression utility. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. (CVE-2024-56826,
CVE-2024-56827)

Frank Zeng discovered that OpenJPEG incorrectly handled memory when using
the decompression utility. An attacker could possibly use this issue to
cause a denial of service or execute arbitrary code. (CVE-2024-56826,
CVE-2024-56827)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
24.10 oracular libopenjp2-7 –  2.5.0-2ubuntu1.2
libopenjp2-tools –  2.5.0-2ubuntu1.2
24.04 noble libopenjp2-7 –  2.5.0-2ubuntu0.3
libopenjp2-tools –  2.5.0-2ubuntu0.3
22.04 jammy libopenjp2-7 –  2.4.0-6ubuntu0.3
libopenjp2-tools –  2.4.0-6ubuntu0.3
libopenjp3d-tools –  2.4.0-6ubuntu0.3
libopenjp3d7 –  2.4.0-6ubuntu0.3
20.04 focal libopenjp2-7 –  2.3.1-1ubuntu4.20.04.4
libopenjp2-tools –  2.3.1-1ubuntu4.20.04.4
libopenjp3d-tools –  2.3.1-1ubuntu4.20.04.4
libopenjp3d7 –  2.3.1-1ubuntu4.20.04.4
18.04 bionic libopenjp2-7 –  2.3.0-2+deb10u2ubuntu0.1~esm4  
libopenjp2-tools –  2.3.0-2+deb10u2ubuntu0.1~esm4  
libopenjp3d-tools –  2.3.0-2+deb10u2ubuntu0.1~esm4  
libopenjp3d7 –  2.3.0-2+deb10u2ubuntu0.1~esm4  
16.04 xenial libopenjp2-7 –  2.1.2-1.1+deb9u6ubuntu0.1~esm7  
libopenjp2-tools –  2.1.2-1.1+deb9u6ubuntu0.1~esm7  
libopenjp3d-tools –  2.1.2-1.1+deb9u6ubuntu0.1~esm7  
libopenjp3d7 –  2.1.2-1.1+deb9u6ubuntu0.1~esm7  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.


Have additional questions?

Talk to a member of the team ›