Mageia 7 MGASA-2020-0464 Moderate: OpenJPEG Encoder Buffer Overflow
mageia
December 20, 2020
A heap-buffer overwrites error was discovered in lib/openjp2/mqc.c in OpenJPEG 2.3.1
Summary
A heap-buffer overwrites error was discovered in lib/openjp2/mqc.c in OpenJPEG
2.3.1. The vulnerability causes an out-of-bounds write, which may lead to
remote denial of service or possibly remote code execution (CVE-2020-27814).
A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass
specially crafted x,y offset input to OpenJPEG to use during encoding. The
highest threat from this vulnerability is to confidentiality, integrity, as
well as system availability (CVE-2020-27823).
There is a flaw in openjpeg's encoder in the opj_dwt_calc_explicit_stepsizes()
function. An attacker who is able to supply crafted input to decomposition
levels could cause a buffer overflow, potentially causing an impact to
application availability (CVE-2020-27824).
References
- https://bugs.mageia.org/show_bug.cgi?id=27822
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IT4DFBK3FQCB3UOEAZ4XYIDFSWQRMNDX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OQR4EWRFFZQDMFPZKFZ6I3USLMW6TKTP/
- https://www.cve.org/CVERecord?id=CVE-2020-27814
- https://www.cve.org/CVERecord?id=CVE-2020-27823
- https://www.cve.org/CVERecord?id=CVE-2020-27824
Resolution
SRPMS
- 7/core/openjpeg2-2.3.1-1.5.mga7
PREVIOUS
NEXT
Publication date: 20 Dec 2020
URL: https://advisories.mageia.org/MGASA-2020-0464.html
Type: security
CVE: CVE-2020-27814,
CVE-2020-27823,
CVE-2020-27824
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!