CVE-2019-12973

Name of the Vulnerable Software and Affected Versions OpenJPEG version 2.3.1

Description The issue is related to excessive iteration in the opj t1 encode cblks function of openjp2/t1.c. Remote attackers could leverage this to cause a denial of service via a crafted bmp file.

Recommendations For OpenJPEG version 2.3.1, consider disabling the opj t1 encode cblks function as a temporary workaround until a patch is available. Restrict access to handling crafted bmp files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.