CVE-2020-27845: Buffer Overflow
A flaw was found in OpenJPEG. Specially crafted input file can lead to a heap-based buffer overflow in functions opjpinextrlcp, opjpinextrpcl and opjpinextlrcp in openjp2/pi.c.
Reference: https://github.com/uclouvain/openjpeg/issues/1302
Other sources
There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openjpegto a version that resolves this vulnerability.Fixed in 2.4.0 - Upgrade
Upgrade
debian/openjpeg2to a version that resolves this vulnerability.Fixed in 2.4.0-3Fixed in 2.4.0-3+deb11u1Fixed in 2.5.0-2+deb12u1Fixed in 2.5.3-2 - Upgrade
Upgrade
openjpegto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2020-27845.
What is the severity of CVE-2020-27845?
The severity of CVE-2020-27845 is medium (5.5).
What is the impact of this flaw?
The highest impact of this flaw is to application availability.
Which software versions are affected by CVE-2020-27845?
Versions prior to 2.4.0 of openjpeg are affected by CVE-2020-27845.
How can an attacker exploit CVE-2020-27845?
An attacker can exploit CVE-2020-27845 by providing untrusted input to openjpeg's conversion/encoding functionality, leading to an out-of-bounds read.