Vulnerability Details : CVE-2020-27814
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.
Vulnerability category: OverflowExecute code
Products affected by CVE-2020-27814
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:uclouvain:openjpeg:*:*:*:*:*:*:*:*
- cpe:2.3:a:uclouvain:openjpeg:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-27814
0.24%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 62 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-27814
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2020-27814
-
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Assigned by: secalert@redhat.com (Primary)
References for CVE-2020-27814
-
https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
[SECURITY] [DLA 2550-1] openjpeg2 security updateMailing List;Third Party Advisory
-
https://www.debian.org/security/2021/dsa-4882
Debian -- Security Information -- DSA-4882-1 openjpeg2Third Party Advisory
-
https://www.oracle.com//security-alerts/cpujul2021.html
Oracle Critical Patch Update Advisory - July 2021Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1901998
1901998 – (CVE-2020-27814) CVE-2020-27814 openjpeg: Heap-buffer-overflow in lib/openjp2/mqc.c could result in DoSIssue Tracking;Patch;Third Party Advisory
-
https://github.com/uclouvain/openjpeg/issues/1283
Heap-buffer-overflow in lib/openjp2/mqc.c:499 · Issue #1283 · uclouvain/openjpeg · GitHubExploit;Issue Tracking;Third Party Advisory
-
https://security.gentoo.org/glsa/202101-29
OpenJPEG: Multiple vulnerabilities (GLSA 202101-29) — Gentoo securityThird Party Advisory
Jump to