PT-2020-4486 · Openjpeg+9 · Openjpeg+9

Published 2020-06-29 · Updated 2023-03-15 · CVE-2020-15389

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenJPEG versions through 2.3.1

Description The issue is related to a use-after-free in the jp2/opj decompress.c component of the OpenJPEG library, which can be triggered by a mix of valid and invalid files in a directory operated on by the decompressor. This may allow a remote attacker to disclose protected information or cause a denial of service. The vulnerability is also related to calling the opj image destroy function twice, which may trigger a double-free.

Recommendations For OpenJPEG versions through 2.3.1, consider disabling the opj image destroy function until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2021:4251

ALT-PU-2020-3564

AZL-44193

BDU:2020-05034

CESA-2021_4251

CVE-2020-15389

DLA-2277-1

DSA-4882-1

MGASA-2020-0307

OPENSUSE-SU-2022_1252-1

OPENSUSE-SU-2022_1296-1

OPENSUSE-SU-2024:13571-1

RHSA-2021:4251

RHSA-2021_4251

RLSA-2021:4251

SUSE-SU-2022:1129-1

SUSE-SU-2022:1252-1

SUSE-SU-2022:1296-1

USN-4497-1

USN-4685-1

USN-5952-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Openjpeg

Red Hat

Rocky Linux

Suse

Ubuntu

References · 122

• https://github.com/uclouvain/openjpeg/issues/1261 · Patch
• https://linux.oracle.com/errata/ELSA-2021-4251.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15389 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4251 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-15389 · Security Note
• https://ubuntu.com/security/CVE-2020-8112 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2021:4251 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44193 · Vendor Advisory
• https://debian.org/lts/security/2020/dla-2277 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27823 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15389 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4497-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27845 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-12973 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05034 · Security Note