CVE-2020-27824
MEDIUM EPSS 72.9%
Published May 13, 20215y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Published May 13, 2021 5y ago
Last Modified Jun 17, 2026 2w ago
Description
A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
72.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 2
CWE-125 Out-of-bounds Read Memory Safety
CWE-20 Improper Input Validation Validation
Affected Products 6
| Vendor | Product | Version | Range |
|---|---|---|---|
| uclouvain | openjpeg | * | <2.4.0 |
| redhat | enterprise_linux | 8.0 | any |
| fedoraproject | fedora | 32 | any |
| fedoraproject | fedora | 33 | any |
| debian | debian_linux | 9.0 | any |
| debian | debian_linux | 10.0 | any |
References 6
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1905723
- lists.debian.org https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQR4EWRFFZQDMFPZKFZ6I3USLMW6TKTP/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/
- debian.org https://www.debian.org/security/2021/dsa-4882
- oracle.com https://www.oracle.com/security-alerts/cpuoct2021.html
Remediation
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1905723
- oracle.com https://www.oracle.com/security-alerts/cpuoct2021.html