VulnerabilityModified
CVE-2020-27814
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files.
HIGH 7.8EPSS 2.01%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.01%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 2.01% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-122
- Affected
- uclouvain/openjpeg · debian/debian linux
- Source
- secalert@redhat.com
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1901998Issue Tracking, Patch, Third Party Advisory
- https://github.com/uclouvain/openjpeg/issues/1283Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00011.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202101-29Third Party Advisory
- https://www.debian.org/security/2021/dsa-4882Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1901998Issue Tracking, Patch, Third Party Advisory
- https://github.com/uclouvain/openjpeg/issues/1283Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/02/msg00011.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202101-29Third Party Advisory
- https://www.debian.org/security/2021/dsa-4882Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.