SUSE update for openjpeg2

1) Divide-by-zero

EUVDB-ID: #VU13982

Risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-14423

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to multiple division-by-zero conditions that exist in the pi_next_pcrl, pi_next_cprl, and pi_next_rpcl functions, as defined in the lib/openjp3d/pi.c source code file. A remote attacker can trick the victim into opening a specially crafted file with an application that uses the affected library and cause the affected application to crash.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU36741

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-16375

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in OpenJPEG 2.3.0. Missing checks for header_info.height and header_info.width in the function pnmtoimage in bin/jpwl/convert.c can lead to a heap-based buffer overflow.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds write

EUVDB-ID: #VU36742

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-16376

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An issue was discovered in OpenJPEG 2.3.0. A heap-based buffer overflow was discovered in the function t2_encode_packet in lib/openmj2/t2.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Division by zero

EUVDB-ID: #VU63447

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-20845

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error in the functions pi_next_pcrl(), pi_next_cprl(), and pi_next_rpcl() in openmj2/pi.c. A remote attacker can create a specially crafted file, trick the victim into opening it and cause a denial of service.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Integer overflow

EUVDB-ID: #VU37631

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-5727

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Integer overflow

EUVDB-ID: #VU20493

Risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-5785

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform denial of service (DoS) attack.

The vulnerability exists due to integer overflow in opj_j2k_setup_encoder function (openjp2/j2k.c). A remote attacker can create a specially crafted bmp image, trigger integer overflow and crash the affected application.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper input validation

EUVDB-ID: #VU11479

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2018-6616

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the opj_t1_encode_cblks function, which is defined in the openjp2/t1.c source code file, due to insufficient validation of user-supplied input. A local attacker can submit a specially crafted BMP file and cause the service to crash.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Use-after-free

EUVDB-ID: #VU34190

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-15389

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Heap-based buffer overflow

EUVDB-ID: #VU48907

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-27823

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing PNG images in pngtoimage() function in bin/jp2/convertpng.c. A remote attacker can pass specially crafted file to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Heap-based buffer overflow

EUVDB-ID: #VU24306

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2020-6851

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the opj_t1_clbl_decode_processor() function in libopenjp2.so. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Heap-based buffer overflow

EUVDB-ID: #VU25546

Risk: Medium

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-8112

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the the qmfbid==1 case, a different issue than CVE-2020-6851. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Integer overflow

EUVDB-ID: #VU63449

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-29338

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to integer overflow when using the command line option "-ImgDir" on a directory that contains 1048576 files. A remote attacker can pass specially crafted data to the application, trigger integer overflow and perform a denial of service attack.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Access of Uninitialized Pointer

EUVDB-ID: #VU63450

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-1122

CWE-ID: CWE-824 - Access of Uninitialized Pointer

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to an invalid pointer initialization in the opj2_decompress program. A remote attacker can gain unauthorized access to sensitive information and perform a denial of service attack.

Mitigation

Update the affected package openjpeg2 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Realtime Extension: 15-SP2

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP3

SUSE Linux Enterprise Server: 15-LTSS - 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-ESPOS - 15-SP4

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1 - 4.2

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1 - 4.2

SUSE Linux Enterprise Module for Basesystem: 15-SP3 - 15-SP4

SUSE Linux Enterprise Desktop: 15-SP3 - 15-SP4

SUSE CaaS Platform: 4.0

openSUSE Leap: 15.3 - 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP3 - 15-SP4

SUSE Linux Enterprise Module for Packagehub Subpackages: 15-SP3

libopenjp2-7-32bit-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7-32bit: before 2.3.0-150000.3.5.1

openjpeg2-devel: before 2.3.0-150000.3.5.1

openjpeg2-debugsource: before 2.3.0-150000.3.5.1

openjpeg2-debuginfo: before 2.3.0-150000.3.5.1

openjpeg2: before 2.3.0-150000.3.5.1

libopenjp2-7-debuginfo: before 2.3.0-150000.3.5.1

libopenjp2-7: before 2.3.0-150000.3.5.1

CPE2.3

• cpe:2.3:o:suse:suse_linux_enterprise_realtime_extension:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP2:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-BCL:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-ESPOS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP1-LTSS:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_enterprise_storage:6:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_retail_branch_server:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_manager_proxy:4.1:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_basesystem:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_caas_platform:4.0:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:suse_linux_enterprise_module_for_packagehub_subpackages:15-SP3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-32bit:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-devel:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debugsource:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:openjpeg2:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7-debuginfo:*:*:*:*:*:suse_linux:*:*
• cpe:2.3:o:suse:libopenjp2-7:*:*:*:*:*:suse_linux:*:*

External links

https://www.suse.com/support/update/announcement/2022/suse-su-20221252-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.