Log in Start free

Vulnerability · Published Mar 29, 2022 · Assigned by redhat

CVE-2022-1122

Medium 5.5

In plain English

A medium-severity security flaw in openjpeg2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)1.1%top 34.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8openjpeg22.4.0-5.el8ALSA-2022:7645
AlmaLinux:9openjpeg22.4.0-7.el9ALSA-2022:8207
AlmaLinux:8openjpeg2-devel2.4.0-5.el8ALSA-2022:7645
AlmaLinux:9openjpeg2-devel2.4.0-7.el9ALSA-2022:8207
AlmaLinux:8openjpeg2-devel-docs2.4.0-5.el8ALSA-2022:7645
AlmaLinux:8openjpeg2-tools2.4.0-5.el8ALSA-2022:7645
AlmaLinux:9openjpeg2-tools2.4.0-7.el9ALSA-2022:8207
Alpine:v3.20openjpeg2.5.0-r0ALPINE-CVE-2022-1122
Alpine:v3.21openjpeg2.5.0-r0ALPINE-CVE-2022-1122
Alpine:v3.22openjpeg2.5.0-r0ALPINE-CVE-2022-1122
Alpine:v3.23openjpeg2.5.0-r0ALPINE-CVE-2022-1122
Alpine:v3.24openjpeg2.5.0-r0ALPINE-CVE-2022-1122
Debian:12openjpeg22.5.0-1DEBIAN-CVE-2022-1122
Debian:13openjpeg22.5.0-1DEBIAN-CVE-2022-1122
Debian:14openjpeg22.5.0-1DEBIAN-CVE-2022-1122
Rocky Linux:8openjpeg20:2.4.0-5.el8RLSA-2022:7645
Rocky Linux:9openjpeg20:2.4.0-7.el9RLSA-2022:8207
Ubuntu:22.04:LTSblenderno fix listedUBUNTU-CVE-2022-1122
Ubuntu:24.04:LTSblenderno fix listedUBUNTU-CVE-2022-1122
Ubuntu:25.10blenderno fix listedUBUNTU-CVE-2022-1122
Ubuntu:26.04:LTSblenderno fix listedUBUNTU-CVE-2022-1122
Ubuntu:26.10blenderno fix listedUBUNTU-CVE-2022-1122
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2022-1122
Ubuntu:22.04:LTSopenjpeg22.4.0-6ubuntu0.2UBUNTU-CVE-2022-1122
Ubuntu:22.04:LTSopenjpeg22.4.0-6ubuntu0.2USN-7083-1
Ubuntu:24.04:LTSopenjpeg22.5.0-2ubuntu0.2USN-7083-1
Ubuntu:25.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2022-1122
Ubuntu:26.10qtwebengine-opensource-srcno fix listedUBUNTU-CVE-2022-1122
Ubuntu:25.10texmakerno fix listedUBUNTU-CVE-2022-1122
Ubuntu:26.04:LTStexmakerno fix listedUBUNTU-CVE-2022-1122
Ubuntu:26.10texmakerno fix listedUBUNTU-CVE-2022-1122

Affected products (as reported)

VendorProductVersions
n/a openjpeg2 openjpeg2 version 2.4.0 and prior

Weakness: CWE-665

References