CVE-2020-27842

MEDIUM EPSS 69.9%

Published Jan 5, 20215y ago · Modified Jun 17, 20262w ago

5.5 CVSS 3.1

Medium

Published Jan 5, 2021 5y ago

Last Modified Jun 17, 2026 2w ago

Description

There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.

CVSS Details

Base Score

5.5

Exploitability

1.8

Impact

3.6

Vector string

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality None

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

69.9% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 13

Vendor	Product	Version	Range
uclouvain	openjpeg	*	<2.4.0
fedoraproject	extra_packages_for_enterprise_linux	7.0	any
fedoraproject	fedora	32	any
fedoraproject	fedora	33	any
debian	debian_linux	9.0	any
debian	debian_linux	10.0	any
redhat	codeready_linux_builder	8.0	any
redhat	codeready_linux_builder_for_ibm_z_systems	8.0	any
redhat	codeready_linux_builder_for_power_little_endian	8.0	any
redhat	enterprise_linux	8.0	any
redhat	enterprise_linux_for_ibm_z_systems	8.0	any
redhat	enterprise_linux_for_power_little_endian	8.0	any
oracle	outside_in_technology	8.5.5	any

References 7

bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1907513

Issue TrackingPatchThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html

Mailing ListThird Party Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/
security.gentoo.org https://security.gentoo.org/glsa/202101-29

Third Party Advisory
debian.org https://www.debian.org/security/2021/dsa-4882

Mailing ListThird Party Advisory
oracle.com https://www.oracle.com//security-alerts/cpujul2021.html

PatchThird Party Advisory
oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html

PatchThird Party Advisory

Remediation

bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1907513

Issue TrackingPatchThird Party Advisory
oracle.com https://www.oracle.com//security-alerts/cpujul2021.html

PatchThird Party Advisory
oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html

PatchThird Party Advisory