CVE-2020-27844

HIGH EPSS 67.5%
Published Jan 5, 20215y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Jan 5, 2021 5y ago
Last Modified Jun 17, 2026 2w ago

Description

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
67.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

Affected Products 3

VendorProductVersionRange
uclouvainopenjpeg* <2.4.0
debiandebian_linux9.0any
oracleoutside_in_technology8.5.5any

References 5

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1907521
    Issue TrackingPatchThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
    Mailing ListThird Party Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/202101-29
    Third Party Advisory
  • oracle.com https://www.oracle.com//security-alerts/cpujul2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html
    PatchThird Party Advisory

Remediation

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1907521
    Issue TrackingPatchThird Party Advisory
  • oracle.com https://www.oracle.com//security-alerts/cpujul2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html
    PatchThird Party Advisory