Vulnerability Details : CVE-2020-27844
A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Vulnerability category: OverflowMemory CorruptionInput validation
Products affected by CVE-2020-27844
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:uclouvain:openjpeg:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-27844
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 49 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-27844
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.3
|
HIGH | AV:N/AC:M/Au:N/C:P/I:P/A:C |
8.6
|
8.5
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2020-27844
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: secalert@redhat.com (Primary)
-
A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().Assigned by: secalert@redhat.com (Primary)
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by: secalert@redhat.com (Primary)
References for CVE-2020-27844
-
https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
[SECURITY] [DLA 2550-1] openjpeg2 security updateMailing List;Third Party Advisory
-
https://www.oracle.com//security-alerts/cpujul2021.html
Oracle Critical Patch Update Advisory - July 2021Patch;Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1907521
1907521 – (CVE-2020-27844) CVE-2020-27844 openjpeg: heap-based buffer overflow in opj_t2_encode_packet function in openjp2/t2.cIssue Tracking;Patch;Third Party Advisory
-
https://www.oracle.com/security-alerts/cpuApr2021.html
Oracle Critical Patch Update Advisory - April 2021Patch;Third Party Advisory
-
https://security.gentoo.org/glsa/202101-29
OpenJPEG: Multiple vulnerabilities (GLSA 202101-29) — Gentoo securityThird Party Advisory
Jump to