Log in Start free

Vulnerability · Published Apr 14, 2021 · Assigned by mitre

CVE-2021-29338

Medium 5.5

In plain English

A medium-severity security flaw in the openjpeg2 package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)1.6%top 24.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8openjpeg22.4.0-4.el8ALSA-2021:4251
AlmaLinux:8openjpeg2-devel2.4.0-4.el8ALSA-2021:4251
AlmaLinux:8openjpeg2-devel-docs2.4.0-4.el8ALSA-2021:4251
AlmaLinux:8openjpeg2-tools2.4.0-4.el8ALSA-2021:4251
Alpine:v3.20openjpeg2.4.0-r1ALPINE-CVE-2021-29338
Alpine:v3.21openjpeg2.4.0-r1ALPINE-CVE-2021-29338
Alpine:v3.22openjpeg2.4.0-r1ALPINE-CVE-2021-29338
Alpine:v3.23openjpeg2.4.0-r1ALPINE-CVE-2021-29338
Alpine:v3.24openjpeg2.4.0-r1ALPINE-CVE-2021-29338
Debian:12openjpeg22.4.0-4DEBIAN-CVE-2021-29338
Debian:13openjpeg22.4.0-4DEBIAN-CVE-2021-29338
Debian:14openjpeg22.4.0-4DEBIAN-CVE-2021-29338
Rocky Linux:8openjpeg20:2.4.0-4.el8RLSA-2021:4251
Ubuntu:22.04:LTSblenderno fix listedUBUNTU-CVE-2021-29338
Ubuntu:24.04:LTSblenderno fix listedUBUNTU-CVE-2021-29338
Ubuntu:25.10blenderno fix listedUBUNTU-CVE-2021-29338
Ubuntu:26.04:LTSblenderno fix listedUBUNTU-CVE-2021-29338
Ubuntu:26.10blenderno fix listedUBUNTU-CVE-2021-29338
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2021-29338
Ubuntu:22.04:LTSopenjpeg22.4.0-6ubuntu0.2UBUNTU-CVE-2021-29338
Ubuntu:22.04:LTSopenjpeg22.4.0-6ubuntu0.2USN-7083-1
Ubuntu:24.04:LTSopenjpeg22.5.0-2ubuntu0.2USN-7083-1
Ubuntu:25.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2021-29338
Ubuntu:26.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2021-29338
Ubuntu:25.10texmakerno fix listedUBUNTU-CVE-2021-29338
Ubuntu:26.04:LTStexmakerno fix listedUBUNTU-CVE-2021-29338
Ubuntu:26.10texmakerno fix listedUBUNTU-CVE-2021-29338

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References