Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Openjpeg2 may allow attackers to crash the service

published 7 years ago
Summary

The Openjpeg2 library used in Azure can be tricked into reading malformed image data without properly checking its size. This can cause the application to stop working or become unstable. Update to the latest Openjpeg2 version or apply the vendor’s patch to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure openjpeg2 <= 2.3.1-12
Original advisory text
CVE-2017-12652 affecting package openjpeg2 2.3.1-12
libpng before 1.6.32 does not properly check the length of chunks against the user limit.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published10 Jul 2019
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-45102 · OSV
Track software like this
Free during beta