PT-2020-3208 · Openjpeg+6 · Openjpeg+6
Published
2020-01-13
·
Updated
2023-03-15
·
CVE-2020-6851
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
OpenJPEG versions prior to 2.3.2
Description
The issue is related to a heap-based buffer overflow in the
opj t1 clbl decode processor function in openjp2/t1.c due to a lack of opj j2k update image dimensions validation. This can lead to a denial of service. The vulnerability can be exploited by a remote attacker.Recommendations
For OpenJPEG versions prior to 2.3.2, update to version 2.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
opj t1 clbl decode processor function until a patch is available.Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Centos
Openjpeg
Red Hat
Suse
Ubuntu