Vulnerability Details CVE-2020-27845
There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 21.9%
CVSS Severity
CVSS v3 Score 5.5
CVSS v2 Score 4.3
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1907523
- https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/
- https://security.gentoo.org/glsa/202101-29
- https://www.debian.org/security/2021/dsa-4882
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1907523
- https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/
- https://security.gentoo.org/glsa/202101-29
- https://www.debian.org/security/2021/dsa-4882
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
Products affected by CVE-2020-27845
-
cpe:2.3:a:oracle:outside_in_technology:8.5.5
-
cpe:2.3:a:uclouvain:openjpeg:-
-
cpe:2.3:a:uclouvain:openjpeg:1.0
-
cpe:2.3:a:uclouvain:openjpeg:1.1
-
cpe:2.3:a:uclouvain:openjpeg:1.2
-
cpe:2.3:a:uclouvain:openjpeg:1.3
-
cpe:2.3:a:uclouvain:openjpeg:1.4
-
cpe:2.3:a:uclouvain:openjpeg:1.5
-
cpe:2.3:a:uclouvain:openjpeg:1.5.1
-
cpe:2.3:a:uclouvain:openjpeg:1.5.2
-
cpe:2.3:a:uclouvain:openjpeg:2.0
-
cpe:2.3:a:uclouvain:openjpeg:2.0.0
-
cpe:2.3:a:uclouvain:openjpeg:2.0.1
-
cpe:2.3:a:uclouvain:openjpeg:2.1
-
cpe:2.3:a:uclouvain:openjpeg:2.1.0
-
cpe:2.3:a:uclouvain:openjpeg:2.1.1
-
cpe:2.3:a:uclouvain:openjpeg:2.1.2
-
cpe:2.3:a:uclouvain:openjpeg:2.2.0
-
cpe:2.3:a:uclouvain:openjpeg:2.3.0
-
cpe:2.3:a:uclouvain:openjpeg:2.3.1
-
cpe:2.3:o:debian:debian_linux:10.0
-
cpe:2.3:o:debian:debian_linux:9.0
-
cpe:2.3:o:fedoraproject:fedora:32