CVE-2020-27843
MEDIUM EPSS 74.1%
Published Jan 5, 20215y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Published Jan 5, 2021 5y ago
Last Modified Jun 17, 2026 2w ago
Description
A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
74.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-125 Out-of-bounds Read Memory Safety
Affected Products 6
| Vendor | Product | Version | Range |
|---|---|---|---|
| uclouvain | openjpeg | * | <2.4.0 |
| fedoraproject | fedora | 32 | any |
| fedoraproject | fedora | 33 | any |
| oracle | outside_in_technology | 8.5.5 | any |
| debian | debian_linux | 9.0 | any |
| debian | debian_linux | 10.0 | any |
References 7
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1907516
- lists.debian.org https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/
- security.gentoo.org https://security.gentoo.org/glsa/202101-29
- debian.org https://www.debian.org/security/2021/dsa-4882
- oracle.com https://www.oracle.com//security-alerts/cpujul2021.html
- oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html
Remediation
- oracle.com https://www.oracle.com//security-alerts/cpujul2021.html
- oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html