# CVE-2018-5785: openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages ha... CVE-2018-5785 is fixed in 12 products on 1 platform, first by libopenjp2-7 2.3.0-2build0.18.04.1, released October 8, 2018. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2018-5785 - Priority: High - CVSS: 7.8 (Moderate) - EPSS: 0.0233 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jan 18, 2018 ## Description OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages have been upgraded to a later upstream version: openjpeg2 (2.4.0). Security Fix(es): * openjpeg: use-after-free and double-free via a mix of valid and invalid files in a directory operated on by the decompressor (CVE-2020-15389) * openjpeg: heap-buffer-overflow in lib/openjp2/mqc.c could result in DoS (CVE-2020-27814) * openjpeg: heap-buffer-overflow write in opj_tcd_dc_level_shift_encode() (CVE-2020-27823) * openjpeg: heap-buffer-overflow in color.c may lead to DoS or arbitrary code execution (CVE-2021-3575) * openjpeg: integer overflow in opj_t1_encode_cblks in src/lib/openjp2/t1.c (CVE-2018-5727) * openjpeg: integer overflow in opj_j2k_setup_encoder function in openjp2/j2k.c (CVE-2018-5785) * openjpeg: division-by-zero in functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c (CVE-2018-20845) * openjpeg: integer overflow in function opj_get_encoding_parameters in openjp2/pi.c (CVE-2018-20847) * openjpeg: denial of service in function opj_t1_encode_cblks in openjp2/t1.c (CVE-2019-12973) * openjpeg: global-buffer-overflow read in opj_dwt_calc_explicit_stepsizes() (CVE-2020-27824) * openjpeg: null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c (CVE-2020-27842) * openjpeg: out-of-bounds read in opj_t2_encode_packet function in openjp2/t2.c (CVE-2020-27843) * openjpeg: heap-based buffer overflow in functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in openjp2/pi.c (CVE-2020-27845) * openjpeg: out-of-bounds write due to an integer overflow in opj_compress.c (CVE-2021-29338) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libopenjp2-7 Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2build0.18.04.1 | [libopenjp2-7 2.3.0-2build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjp2-7-2.3.0-2build0.18.04.1.md) | Oct 8, 2018 | | Linux | libopenjp2-tools Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2build0.18.04.1 | [libopenjp2-tools 2.3.0-2build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjp2-tools-2.3.0-2build0.18.04.1.md) | Oct 8, 2018 | | Linux | libopenjp3d-tools Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2build0.18.04.1 | [libopenjp3d-tools 2.3.0-2build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjp3d-tools-2.3.0-2build0.18.04.1.md) | Oct 8, 2018 | | Linux | libopenjp3d7 Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2build0.18.04.1 | [libopenjp3d7 2.3.0-2build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjp3d7-2.3.0-2build0.18.04.1.md) | Oct 8, 2018 | | Linux | libopenjpip-dec-server Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2build0.18.04.1 | [libopenjpip-dec-server 2.3.0-2build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjpip-dec-server-2.3.0-2build0.18.04.1.md) | Oct 8, 2018 | | Linux | libopenjpip-server Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2build0.18.04.1 | [libopenjpip-server 2.3.0-2build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjpip-server-2.3.0-2build0.18.04.1.md) | Oct 8, 2018 | | Linux | libopenjpip-viewer Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2build0.18.04.1 | [libopenjpip-viewer 2.3.0-2build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjpip-viewer-2.3.0-2build0.18.04.1.md) | Oct 8, 2018 | | Linux | libopenjpip7 Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2build0.18.04.1 | [libopenjpip7 2.3.0-2build0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjpip7-2.3.0-2build0.18.04.1.md) | Oct 8, 2018 | | Linux | openjpeg2 RHEL 8 | 0:2.4.0-4.el8 | [RHSA-2021:4251](https://patchblox.com/security/data/fix/linux/rhsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2 almalinux 8 | 2.4.0-4.el8 | [ALSA-2021:4251](https://patchblox.com/security/data/fix/linux/alsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2 ol 8 | 0:2.4.0-4.el8 | [ELSA-2021-4251](https://patchblox.com/security/data/fix/linux/elsa-2021-4251.md) | Nov 16, 2021 | | Linux | openjpeg2 rocky 8 | 0:2.4.0-4.el8 | [RLSA-2021:4251](https://patchblox.com/security/data/fix/linux/rlsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-devel RHEL 8 | 0:2.4.0-4.el8 | [RHSA-2021:4251](https://patchblox.com/security/data/fix/linux/rhsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-devel almalinux 8 | 2.4.0-4.el8 | [ALSA-2021:4251](https://patchblox.com/security/data/fix/linux/alsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-devel ol 8 | 0:2.4.0-4.el8 | [ELSA-2021-4251](https://patchblox.com/security/data/fix/linux/elsa-2021-4251.md) | Nov 16, 2021 | | Linux | openjpeg2-devel-docs RHEL 8 | 0:2.4.0-4.el8 | [RHSA-2021:4251](https://patchblox.com/security/data/fix/linux/rhsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-devel-docs almalinux 8 | 2.4.0-4.el8 | [ALSA-2021:4251](https://patchblox.com/security/data/fix/linux/alsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-devel-docs ol 8 | 0:2.4.0-4.el8 | [ELSA-2021-4251](https://patchblox.com/security/data/fix/linux/elsa-2021-4251.md) | Nov 16, 2021 | | Linux | openjpeg2-tools RHEL 8 | 0:2.4.0-4.el8 | [RHSA-2021:4251](https://patchblox.com/security/data/fix/linux/rhsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-tools almalinux 8 | 2.4.0-4.el8 | [ALSA-2021:4251](https://patchblox.com/security/data/fix/linux/alsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-tools ol 8 | 0:2.4.0-4.el8 | [ELSA-2021-4251](https://patchblox.com/security/data/fix/linux/elsa-2021-4251.md) | Nov 16, 2021 | --- Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.