CVE-2023-39328

MediumCVSS 5.5/10Last modified Nov 7, 2026

Description

A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
—	—	2.5.0
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—

References

https://access.redhat.com/security/cve/CVE-2023-39328Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2219236Issue Tracking, Third Party Advisory
https://github.com/uclouvain/openjpeg/issues/1476
https://github.com/uclouvain/openjpeg/pull/1470
https://github.com/uclouvain/openjpeg/pull/1471
https://access.redhat.com/security/cve/CVE-2023-39328Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2219236Issue Tracking, Third Party Advisory

Timeline

Published: Jul 9, 2024
Last modified: Nov 7, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-393296.5A flaw was found in OpenJPEG. A resource exhaustion can occur in the opj_t1_decode_cblks function in tcd.c through a crafted image file, cau CVE-2023-39336.1The Your Journey theme for WordPress is vulnerable to Reflected Cross-Site Scripting via prototype pollution in versions up to, and includin CVE-2023-393317.5A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traversal vulnerability ari CVE-2023-393329.8Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, the `Buffer` class ex CVE-2023-393335.3Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code. The injected code may be able to access data CVE-2023-393359.8A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to imp CVE-2023-393368.8An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the int CVE-2023-393379.1A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier t CVE-2023-393386.8Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sen CVE-2023-393394.9A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary fi CVE-2023-393407.5A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to CVE-2023-393413.3"FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to deni