Comment by Tommy Hodgins on "JPEG2000 was better than JPEG. Then why couldn't it replace it?"

JPEG stands for Joint Photographic Experts Group. The whole point of the JPEG committee was to define a standard for lossy compression for photographs - so it makes a ton of sense that file formats based on this JPEG standard (like .jpg) are used in digital photography.

For the web however, JPG isn't the only image format that's used, so I don't understand how it's a 'clear winner' of anything. JPG, PNG, GIF, and SVG all see lots of usage, and while for some images they can be used interchangeably, they all have different strengths:

JPG is great for photographs
PNG is great for lossless compression and alpha transparency
GIF is great for animated images
SVG is great for vector graphics (the opposite of a pixel-based image format)

Why did the JPEG2000 file format never take off? I have one theory - there was a zero-day exploit found in many JPEG2000-reading programs that would allow a malicious person to embed a virus inside a JPEG2000 image, which would infect the computer of any person who simply viewed the JPEG2000 file. By 'opening' or displaying the file, the malicious code was run, which led many people to avoiding JPEG2000 for security reasons, and I've never really heard or seen it used since then. For a lot of people, this security vulnerability was the first (and maybe only) exposure to the JPEG2000 file format, so I don't really see people using it any more.

Unless I'm mistaken, the ONLY Jpeg2000 exploit was a bug in the OpenJPEG library (CVE-2016-8332), and was only discovered a little over a year ago! That is NOT a reason for a now 17 year old file format/encoding to have failed to gain traction.

Since yes, the first version of JPEG2000 did in fact come out in ... 2000. (ISO/IEC 15444-1). Proper program support didn't come along until around 2002 (ISO/IEC 15444-3) when conformance testing was complete.

REGULAR jpeg files DID have an exploit in Wordperfect, Netscape, and a few other programs back in 2004 though. That might be what you're thinking of if "period correct" to when it could have taken off. Otherwise, you didn't even hear about the format until last year despite it being over a decade and a half old.

I was actually a little surprised last year when it even came up as an issue... as that would be like finding out that betamax players cause cancer in 1998. It was never widespread adopted in the decade and a half of proper program support, so it's strange to even hear anyone FINDING a bug much less caring about it.

Although the CVE you've listed is dated 2016, the information I'm talking about:

jpg2000 format
remote code execution

is years old, but the details I'm talking about mirror the 2016 vulnerability more than the 2004 one, which is:

jpg format
buffer overflow

So I'm certainly not referring to the 2004 CVE :S

It was years ago I read about this, the only thing I can ask is: Is it possible there was a jpg2000 remote code execution vulnerability that was known about in some open-source circles without a CVE being filed at that time? It definitely wasn't in 2016 that I heard about this, what I'm talking about was more like 2006-2008 as a timeframe. I remember the big warning was that if your email client automatically downloaded and displayed images you could be compromised before you even saw the image, so the advice at the time was to ensure that email attachments could be downloaded and scanned before being opened/displayed.

Search Hashnode