CVE-2020-15389: Use After Free
jp2/opjdecompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opjimagedestroy twice.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjpeg2to a version that resolves this vulnerability.Fixed in 2.4.0-3Fixed in 2.4.0-3+deb11u1Fixed in 2.5.0-2+deb12u1Fixed in 2.5.3-2
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-15389.
What is the severity level of CVE-2020-15389?
The severity level of CVE-2020-15389 is medium with a score of 6.5.
What is the affected software for CVE-2020-15389?
The affected software is OpenJPEG through version 2.3.1.
What is the impact of CVE-2020-15389?
CVE-2020-15389 can lead to a use-after-free vulnerability and potential double-free, allowing an attacker to execute arbitrary code or cause a denial of service.
Are there any fixes available for CVE-2020-15389?
Yes, fixes are available for CVE-2020-15389. Please refer to the vendor's website or update your software to the latest version.