CVE-2020-27841
MEDIUM EPSS 68.8%
Published Jan 5, 20215y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Published Jan 5, 2021 5y ago
Last Modified Jun 17, 2026 2w ago
Description
There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
68.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 2
CWE-122
CWE-787 Out-of-bounds Write Memory Safety
Affected Products 5
| Vendor | Product | Version | Range |
|---|---|---|---|
| uclouvain | openjpeg | * | <2.4.0 |
| fedoraproject | fedora | 32 | any |
| debian | debian_linux | 9.0 | any |
| debian | debian_linux | 10.0 | any |
| oracle | outside_in_technology | 8.5.5 | any |
References 7
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1907510
- lists.debian.org https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/
- security.gentoo.org https://security.gentoo.org/glsa/202101-29
- debian.org https://www.debian.org/security/2021/dsa-4882
- oracle.com https://www.oracle.com//security-alerts/cpujul2021.html
- oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html
Remediation
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1907510
- oracle.com https://www.oracle.com//security-alerts/cpujul2021.html
- oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html