Summary
Sebastian Poeplau discovered that OpenJPEG incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu 18.04
LTS. (CVE-2020-6851, CVE-2020-8112)
It was discovered that OpenJPEG incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2020-15389, CVE-2020-27814, CVE-2020-27823, CVE-2020-27824,
CVE-2020-27841, CVE-2020-27845)
It was discovered that OpenJPEG incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to cause a denial of
service. (CVE-2020-27842, CVE-2020-27843)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | openjpeg2 | 2.3.0-2+deb10u2build0.18.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | openjpeg2 | 2.1.2-1.1+deb9u6ubuntu0.1~esm3 |
Vulnerabilities 10
-
Unscored —
jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid an…
-
Unscored —
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw…
-
Unscored —
A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to Open…
-
Unscored —CVE-2020-27824 Public exploit
A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker …
-
Unscored —
There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide craf…
-
Unscored —
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to…
-
Unscored —
A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted inpu…
-
Unscored —
There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrus…
-
Unscored —
OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack…
-
Unscored —
opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG 2.3.1 through 2020-01-28 has a heap-based buffer overflow in t…
References
-
report
https://ubuntu.com/security/CVE-2020-6851
-
report
https://ubuntu.com/security/CVE-2020-8112
-
report
https://ubuntu.com/security/CVE-2020-15389
-
report
https://ubuntu.com/security/CVE-2020-27814
-
report
https://ubuntu.com/security/CVE-2020-27823
-
report
https://ubuntu.com/security/CVE-2020-27824
-
report
https://ubuntu.com/security/CVE-2020-27841
-
report
https://ubuntu.com/security/CVE-2020-27842
-
report
https://ubuntu.com/security/CVE-2020-27843
-
report
https://ubuntu.com/security/CVE-2020-27845