OpenJPEG: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Benutzerrechten

Summary

Product

Vulnerabilities 9

• Unscored —
  CVE-2020-15389

  jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid an…

  openjpeg2 openjpeg2 openjpeg2 openjpeg Debian Ubuntu Azure Linux Alpine
  Jun 29, 2020
• Unscored —
  CVE-2020-27814

  A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw…

  ghostscript openjpeg2 qtwebengine-opensource-src openjpeg2 Debian Ubuntu Azure Linux Alpine
  Jan 25, 2021
• Unscored —
  CVE-2020-27823

  A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to Open…

  insighttoolkit4 openjpeg2 qtwebengine-opensource-src openjpeg2 Debian Ubuntu Azure Linux Alpine
  May 13, 2021
• Unscored —
  CVE-2020-27824 Public exploit

  A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker …

  ghostscript insighttoolkit4 openjpeg2 qtwebengine-opensource-src Debian Ubuntu Azure Linux Alpine
  May 13, 2021
• Unscored —
  CVE-2020-27841

  There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide craf…

  ghostscript openjpeg2 qtwebengine-opensource-src openjpeg2 Debian Ubuntu Azure Linux
  Jan 5, 2021
• Unscored —
  CVE-2020-27842

  There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to…

  ghostscript insighttoolkit4 openjpeg2 qtwebengine-opensource-src Debian Ubuntu Azure Linux
  Jan 5, 2021
• Unscored —
  CVE-2020-27843

  A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted inpu…

  ghostscript insighttoolkit4 openjpeg2 qtwebengine-opensource-src Debian Ubuntu Azure Linux
  Jan 5, 2021
• Unscored —
  CVE-2020-27844

  A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide…

  qt5-qtwebengine chromium insighttoolkit4 openjpeg2 Ubuntu Azure Linux Alpine
  Jan 5, 2021
• Unscored —
  CVE-2020-27845

  There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrus…

  ghostscript insighttoolkit4 openjpeg2 qtwebengine-opensource-src Debian Ubuntu Azure Linux
  Jan 5, 2021

Revision history

1. 2023-03-15 #16

   Neue Updates von Ubuntu aufgenommen

2. 2022-11-20 #15

   Neue Updates von SUSE aufgenommen

3. 2022-10-27 #14

   Neue Updates von SUSE aufgenommen

4. 2022-04-21 #13

   Neue Updates von SUSE aufgenommen

5. 2022-04-19 #12

   Neue Updates von SUSE aufgenommen

6. 2022-04-10 #11

   Neue Updates von Debian aufgenommen

7. 2022-04-07 #10

   Neue Updates von SUSE aufgenommen

8. 2022-01-27 #9

   Neue Updates von Amazon aufgenommen

9. 2021-11-09 #8

   Neue Updates von Red Hat aufgenommen

10. 2021-05-13 #7

    CVE ergänzt

11. 2021-04-05 #6

    Neue Updates von Debian aufgenommen

12. 2021-03-15 #5

    Neue Updates von Ubuntu aufgenommen

13. 2021-02-08 #4

    Neue Updates von Debian aufgenommen

14. 2021-01-07 #3

    Neue Updates von Ubuntu aufgenommen

15. 2021-01-05 #2

    CVE Nummern aufgenommen

16. 2020-12-29 #1

    Initiale Fassung

References

• Ubuntu Security Notice USN-5952-1 vom 2023-03-15
  https://ubuntu.com/security/notices/USN-5952-1
• Debian Security Advisory DSA-4882 vom 2021-04-02
  https://www.debian.org/security/2021/dsa-4882
• https://github.com/uclouvain/openjpeg/blob/v2.4.0/CHANGELOG.md vom 2020-12-29
  https://github.com/uclouvain/openjpeg/blob/v2.4.0/CHANGELOG.md
• Ubuntu Security Notice USN-4685-1 vom 2021-01-07
  https://ubuntu.com/security/notices/USN-4685-1
• Ubuntu Security Notice USN-4686-1 vom 2021-01-07
  https://ubuntu.com/security/notices/USN-4686-1
• Debian Security Advisory DLA-2550 vom 2021-02-08
  https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
• Ubuntu Security Notice USN-4880-1 vom 2021-03-16
  https://ubuntu.com/security/notices/USN-4880-1
• Red Hat Security Advisory RHSA-2021:4251 vom 2021-11-09
  https://access.redhat.com/errata/RHSA-2021:4251
• Amazon Linux Security Advisory ALAS-2022-1741 vom 2022-01-27
  https://alas.aws.amazon.com/AL2/ALAS-2022-1741.html
• SUSE Security Update SUSE-SU-2022:1129-1 vom 2022-04-07
  https://lists.suse.com/pipermail/sle-security-updates/2022-April/010666.html
• Debian Security Advisory DLA-2975 vom 2022-04-10
  https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html
• SUSE Security Update SUSE-SU-2022:1252-1 vom 2022-04-19
  https://lists.suse.com/pipermail/sle-security-updates/2022-April/010745.html
• SUSE Security Update SUSE-SU-2022:1296-1 vom 2022-04-21
  https://lists.suse.com/pipermail/sle-security-updates/2022-April/010791.html
• SUSE Security Update SUSE-SU-2022:3801-1 vom 2022-10-27
  https://lists.suse.com/pipermail/sle-security-updates/2022-October/012730.html
• SUSE Security Update SUSE-SU-2022:3802-1 vom 2022-10-27
  https://lists.suse.com/pipermail/sle-security-updates/2022-October/012731.html
• SUSE Security Update SUSE-SU-2022:4082-1 vom 2022-11-18
  https://lists.suse.com/pipermail/sle-security-updates/2022-November/012995.html