CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2020-27814 – openjpeg: heap-buffer-overflow in lib/openjp2/mqc.c could result in DoS
https://notcve.org/view.php?id=CVE-2020-27814
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application. Se encontró un desbordamiento del búfer en la manera en que openjpeg2 manejaba determinados archivos en formato PNG. Un atacante podría usar este fallo para causar el bloqueo de una aplicación o, en algunos casos, ejecutar código arbitrario con el permiso del usuario que ejecuta dicha aplicación • https://bugzilla.redhat.com/show_bug.cgi?id=1901998 https://github.com/uclouvain/openjpeg/issues/1283 https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html https://security.gentoo.org/glsa/202101-29 https://www.debian.org/security/2021/dsa-4882 https://www.oracle.com//security-alerts/cpujul2021.html https://access.redhat.com/security/cve/CVE-2020-27814 • CWE-122: Heap-based Buffer Overflow •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2020-27845 – openjpeg: heap-based buffer overflow in functions opj_pi_next_rlcp, opj_pi_next_rpcl and opj_pi_next_lrcp in openjp2/pi.c
https://notcve.org/view.php?id=CVE-2020-27845
There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability. Se presenta un fallo en el archivo src/lib/openjp2/pi.c de openjpeg en versiones anteriores a 2.4.0. Si un atacante puede proporcionar una entrada que no sea confiable para la funcionalidad conversion/encoding de openjpeg, podría causar una lectura fuera de límites. • https://bugzilla.redhat.com/show_bug.cgi?id=1907523 https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV https://security.gentoo.org/glsa/202101-29 https://www.debian.org/security/2021/dsa-4882 https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuApr2021.html https://access.redhat.com/security/cve/CVE-2020-27845 • CWE-125: Out-of-bounds Read •
CVSS: 8.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-27844
https://notcve.org/view.php?id=CVE-2020-27844
A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Se encontró un fallo en el archivo src/lib/openjp2/t2.c de openjpeg en versiones anteriores a 2.4.0. Este fallo permite a un atacante proporcionar una entrada diseñada para openjpeg durante la conversión y codificación, causando una escritura fuera de límites. • https://bugzilla.redhat.com/show_bug.cgi?id=1907521 https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html https://security.gentoo.org/glsa/202101-29 https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuApr2021.html • CWE-20: Improper Input Validation •
CVSS: 7.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-27843 – openjpeg: out-of-bounds read in opj_t2_encode_packet function in openjp2/t2.c
https://notcve.org/view.php?id=CVE-2020-27843
A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability. Se encontró un fallo en OpenJPEG en versiones anteriores a 2.4.0. Este fallo permite a un atacante proporcionar una entrada especialmente diseñada para la funcionalidad conversion o encoding, causando una lectura fuera de límites. • https://bugzilla.redhat.com/show_bug.cgi?id=1907516 https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV https://security.gentoo.org/glsa/202101-29 https://www.debian.org/security/2021/dsa-4882 https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuApr2021.html https://access.redhat.com/security/cve/CVE-2020-27843 • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 13EXPL: 0CVE-2020-27842 – openjpeg: null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c
https://notcve.org/view.php?id=CVE-2020-27842
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability. Se presenta un fallo en el codificador t2 de openjpeg en versiones anteriores a 2.4.0. Un atacante que sea capaz de proporcionar una entrada diseñada para ser procesada por openjpeg podría causar una desreferencia del puntero null. • https://bugzilla.redhat.com/show_bug.cgi?id=1907513 https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV https://security.gentoo.org/glsa/202101-29 https://www.debian.org/security/2021/dsa-4882 https://www.oracle.com//security-alerts/cpujul2021.html https://www.oracle.com/security-alerts/cpuApr2021.html https://access.redhat.com/security/cve/CVE-2020-27842 • CWE-125: Out-of-bounds Read •