# CVE-2021-29338: openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages ha... CVE-2021-29338 is fixed in 15 products on 1 platform, first by RHSA-2021:4251, released November 9, 2021. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2021-29338 - Priority: High - CVSS: 7.8 (Moderate) - EPSS: 0.0156 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 14, 2021 ## Description OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages have been upgraded to a later upstream version: openjpeg2 (2.4.0). Security Fix(es): * openjpeg: use-after-free and double-free via a mix of valid and invalid files in a directory operated on by the decompressor (CVE-2020-15389) * openjpeg: heap-buffer-overflow in lib/openjp2/mqc.c could result in DoS (CVE-2020-27814) * openjpeg: heap-buffer-overflow write in opj_tcd_dc_level_shift_encode() (CVE-2020-27823) * openjpeg: heap-buffer-overflow in color.c may lead to DoS or arbitrary code execution (CVE-2021-3575) * openjpeg: integer overflow in opj_t1_encode_cblks in src/lib/openjp2/t1.c (CVE-2018-5727) * openjpeg: integer overflow in opj_j2k_setup_encoder function in openjp2/j2k.c (CVE-2018-5785) * openjpeg: division-by-zero in functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c (CVE-2018-20845) * openjpeg: integer overflow in function opj_get_encoding_parameters in openjp2/pi.c (CVE-2018-20847) * openjpeg: denial of service in function opj_t1_encode_cblks in openjp2/t1.c (CVE-2019-12973) * openjpeg: global-buffer-overflow read in opj_dwt_calc_explicit_stepsizes() (CVE-2020-27824) * openjpeg: null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c (CVE-2020-27842) * openjpeg: out-of-bounds read in opj_t2_encode_packet function in openjp2/t2.c (CVE-2020-27843) * openjpeg: heap-based buffer overflow in functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in openjp2/pi.c (CVE-2020-27845) * openjpeg: out-of-bounds write due to an integer overflow in opj_compress.c (CVE-2021-29338) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libopenjp2-7 Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2+deb10u2ubuntu0.1~esm3 | [libopenjp2-7 2.3.0-2+deb10u2ubuntu0.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjp2-7-2.3.0-2-deb10u2ubuntu0.1-esm3.md) | Mar 29, 2022 | | Linux | libopenjp2-7 Ubuntu 20.04 LTS (focal) | 2.3.1-1ubuntu4.20.04.3 | [libopenjp2-7 2.3.1-1ubuntu4.20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libopenjp2-7-2.3.1-1ubuntu4.20.04.3.md) | Mar 29, 2022 | | Linux | libopenjp2-7 Ubuntu 22.04.1 LTS (jammy) | 2.4.0-6ubuntu0.2 | [libopenjp2-7 2.4.0-6ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libopenjp2-7-2.4.0-6ubuntu0.2.md) | Mar 29, 2022 | | Linux | libopenjp2-tools Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2+deb10u2ubuntu0.1~esm3 | [libopenjp2-tools 2.3.0-2+deb10u2ubuntu0.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjp2-tools-2.3.0-2-deb10u2ubuntu0.1-esm3.md) | Mar 29, 2022 | | Linux | libopenjp2-tools Ubuntu 20.04 LTS (focal) | 2.3.1-1ubuntu4.20.04.3 | [libopenjp2-tools 2.3.1-1ubuntu4.20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libopenjp2-tools-2.3.1-1ubuntu4.20.04.3.md) | Mar 29, 2022 | | Linux | libopenjp2-tools Ubuntu 22.04.1 LTS (jammy) | 2.4.0-6ubuntu0.2 | [libopenjp2-tools 2.4.0-6ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libopenjp2-tools-2.4.0-6ubuntu0.2.md) | Mar 29, 2022 | | Linux | libopenjp3d-tools Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2+deb10u2ubuntu0.1~esm3 | [libopenjp3d-tools 2.3.0-2+deb10u2ubuntu0.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjp3d-tools-2.3.0-2-deb10u2ubuntu0.1-esm3.md) | Mar 29, 2022 | | Linux | libopenjp3d-tools Ubuntu 20.04 LTS (focal) | 2.3.1-1ubuntu4.20.04.3 | [libopenjp3d-tools 2.3.1-1ubuntu4.20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libopenjp3d-tools-2.3.1-1ubuntu4.20.04.3.md) | Mar 29, 2022 | | Linux | libopenjp3d-tools Ubuntu 22.04.1 LTS (jammy) | 2.4.0-6ubuntu0.2 | [libopenjp3d-tools 2.4.0-6ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libopenjp3d-tools-2.4.0-6ubuntu0.2.md) | Mar 29, 2022 | | Linux | libopenjp3d7 Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2+deb10u2ubuntu0.1~esm3 | [libopenjp3d7 2.3.0-2+deb10u2ubuntu0.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjp3d7-2.3.0-2-deb10u2ubuntu0.1-esm3.md) | Mar 29, 2022 | | Linux | libopenjp3d7 Ubuntu 20.04 LTS (focal) | 2.3.1-1ubuntu4.20.04.3 | [libopenjp3d7 2.3.1-1ubuntu4.20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libopenjp3d7-2.3.1-1ubuntu4.20.04.3.md) | Mar 29, 2022 | | Linux | libopenjp3d7 Ubuntu 22.04.1 LTS (jammy) | 2.4.0-6ubuntu0.2 | [libopenjp3d7 2.4.0-6ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libopenjp3d7-2.4.0-6ubuntu0.2.md) | Mar 29, 2022 | | Linux | libopenjpip-dec-server Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2+deb10u2ubuntu0.1~esm3 | [libopenjpip-dec-server 2.3.0-2+deb10u2ubuntu0.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjpip-dec-server-2.3.0-2-deb10u2ubuntu0.1-esm3.md) | Mar 29, 2022 | | Linux | libopenjpip-dec-server Ubuntu 20.04 LTS (focal) | 2.3.1-1ubuntu4.20.04.3 | [libopenjpip-dec-server 2.3.1-1ubuntu4.20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libopenjpip-dec-server-2.3.1-1ubuntu4.20.04.3.md) | Mar 29, 2022 | | Linux | libopenjpip-dec-server Ubuntu 22.04.1 LTS (jammy) | 2.4.0-6ubuntu0.2 | [libopenjpip-dec-server 2.4.0-6ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libopenjpip-dec-server-2.4.0-6ubuntu0.2.md) | Mar 29, 2022 | | Linux | libopenjpip-server Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2+deb10u2ubuntu0.1~esm3 | [libopenjpip-server 2.3.0-2+deb10u2ubuntu0.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjpip-server-2.3.0-2-deb10u2ubuntu0.1-esm3.md) | Mar 29, 2022 | | Linux | libopenjpip-server Ubuntu 20.04 LTS (focal) | 2.3.1-1ubuntu4.20.04.3 | [libopenjpip-server 2.3.1-1ubuntu4.20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libopenjpip-server-2.3.1-1ubuntu4.20.04.3.md) | Mar 29, 2022 | | Linux | libopenjpip-server Ubuntu 22.04.1 LTS (jammy) | 2.4.0-6ubuntu0.2 | [libopenjpip-server 2.4.0-6ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libopenjpip-server-2.4.0-6ubuntu0.2.md) | Mar 29, 2022 | | Linux | libopenjpip-viewer Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2+deb10u2ubuntu0.1~esm3 | [libopenjpip-viewer 2.3.0-2+deb10u2ubuntu0.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjpip-viewer-2.3.0-2-deb10u2ubuntu0.1-esm3.md) | Mar 29, 2022 | | Linux | libopenjpip-viewer Ubuntu 20.04 LTS (focal) | 2.3.1-1ubuntu4.20.04.3 | [libopenjpip-viewer 2.3.1-1ubuntu4.20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libopenjpip-viewer-2.3.1-1ubuntu4.20.04.3.md) | Mar 29, 2022 | | Linux | libopenjpip-viewer Ubuntu 22.04.1 LTS (jammy) | 2.4.0-6ubuntu0.2 | [libopenjpip-viewer 2.4.0-6ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libopenjpip-viewer-2.4.0-6ubuntu0.2.md) | Mar 29, 2022 | | Linux | libopenjpip7 Ubuntu 18.04.6 LTS (bionic) | 2.3.0-2+deb10u2ubuntu0.1~esm3 | [libopenjpip7 2.3.0-2+deb10u2ubuntu0.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libopenjpip7-2.3.0-2-deb10u2ubuntu0.1-esm3.md) | Mar 29, 2022 | | Linux | libopenjpip7 Ubuntu 20.04 LTS (focal) | 2.3.1-1ubuntu4.20.04.3 | [libopenjpip7 2.3.1-1ubuntu4.20.04.3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libopenjpip7-2.3.1-1ubuntu4.20.04.3.md) | Mar 29, 2022 | | Linux | libopenjpip7 Ubuntu 22.04.1 LTS (jammy) | 2.4.0-6ubuntu0.2 | [libopenjpip7 2.4.0-6ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libopenjpip7-2.4.0-6ubuntu0.2.md) | Mar 29, 2022 | | Linux | openjpeg2 Debian 11.6 (bullseye) | 2.4.0-3+deb11u1 | [DLA-4107-1](https://patchblox.com/security/data/fix/linux/dla-4107-1.md) | Apr 1, 2025 | | Linux | openjpeg2 RHEL 8 | 0:2.4.0-4.el8 | [RHSA-2021:4251](https://patchblox.com/security/data/fix/linux/rhsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2 almalinux 8 | 2.4.0-4.el8 | [ALSA-2021:4251](https://patchblox.com/security/data/fix/linux/alsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2 amzn 2023 | 2.4.0-11.amzn2023.0.3 | [ALAS2023-2023-040](https://patchblox.com/security/data/fix/linux/alas2023-2023-040.md) | Feb 17, 2023 | | Linux | openjpeg2 ol 8 | 0:2.4.0-4.el8 | [ELSA-2021-4251](https://patchblox.com/security/data/fix/linux/elsa-2021-4251.md) | Nov 16, 2021 | | Linux | openjpeg2 rocky 8 | 0:2.4.0-4.el8 | [RLSA-2021:4251](https://patchblox.com/security/data/fix/linux/rlsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-debuginfo amzn 2023 | 2.4.0-11.amzn2023.0.3 | [ALAS2023-2023-040](https://patchblox.com/security/data/fix/linux/alas2023-2023-040.md) | Feb 17, 2023 | | Linux | openjpeg2-debugsource amzn 2023 | 2.4.0-11.amzn2023.0.3 | [ALAS2023-2023-040](https://patchblox.com/security/data/fix/linux/alas2023-2023-040.md) | Feb 17, 2023 | | Linux | openjpeg2-devel RHEL 8 | 0:2.4.0-4.el8 | [RHSA-2021:4251](https://patchblox.com/security/data/fix/linux/rhsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-devel almalinux 8 | 2.4.0-4.el8 | [ALSA-2021:4251](https://patchblox.com/security/data/fix/linux/alsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-devel amzn 2023 | 2.4.0-11.amzn2023.0.3 | [ALAS2023-2023-040](https://patchblox.com/security/data/fix/linux/alas2023-2023-040.md) | Feb 17, 2023 | | Linux | openjpeg2-devel ol 8 | 0:2.4.0-4.el8 | [ELSA-2021-4251](https://patchblox.com/security/data/fix/linux/elsa-2021-4251.md) | Nov 16, 2021 | | Linux | openjpeg2-devel-docs RHEL 8 | 0:2.4.0-4.el8 | [RHSA-2021:4251](https://patchblox.com/security/data/fix/linux/rhsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-devel-docs almalinux 8 | 2.4.0-4.el8 | [ALSA-2021:4251](https://patchblox.com/security/data/fix/linux/alsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-devel-docs amzn 2023 | 2.4.0-11.amzn2023.0.3 | [ALAS2023-2023-040](https://patchblox.com/security/data/fix/linux/alas2023-2023-040.md) | Feb 17, 2023 | | Linux | openjpeg2-devel-docs ol 8 | 0:2.4.0-4.el8 | [ELSA-2021-4251](https://patchblox.com/security/data/fix/linux/elsa-2021-4251.md) | Nov 16, 2021 | | Linux | openjpeg2-tools RHEL 8 | 0:2.4.0-4.el8 | [RHSA-2021:4251](https://patchblox.com/security/data/fix/linux/rhsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-tools almalinux 8 | 2.4.0-4.el8 | [ALSA-2021:4251](https://patchblox.com/security/data/fix/linux/alsa-2021-4251.md) | Nov 9, 2021 | | Linux | openjpeg2-tools amzn 2023 | 2.4.0-11.amzn2023.0.3 | [ALAS2023-2023-040](https://patchblox.com/security/data/fix/linux/alas2023-2023-040.md) | Feb 17, 2023 | | Linux | openjpeg2-tools ol 8 | 0:2.4.0-4.el8 | [ELSA-2021-4251](https://patchblox.com/security/data/fix/linux/elsa-2021-4251.md) | Nov 16, 2021 | | Linux | openjpeg2-tools-debuginfo amzn 2023 | 2.4.0-11.amzn2023.0.3 | [ALAS2023-2023-040](https://patchblox.com/security/data/fix/linux/alas2023-2023-040.md) | Feb 17, 2023 | --- Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.