| Name | CVE-2020-27814 |
| Description | A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-2550-1, DSA-4882-1 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| openjpeg2 (PTS) | jessie, jessie (lts) | 2.1.0-2+deb8u14 | fixed |
| stretch (security), stretch (lts), stretch | 2.1.2-1.1+deb9u7 | fixed |
| buster (security), buster, buster (lts) | 2.3.0-2+deb10u2 | fixed |
| bullseye | 2.4.0-3 | fixed |
| sid, trixie, bookworm | 2.5.0-2 | fixed |
The information below is based on the following data on fixed versions.
Notes
https://github.com/uclouvain/openjpeg/issues/1283
https://github.com/uclouvain/openjpeg/commit/eaa098b59b346cb88e4d10d505061f669d7134fc (v2.4.0)
https://github.com/uclouvain/openjpeg/commit/15cf3d95814dc931ca0ecb132f81cb152e051bae (v2.4.0)
https://github.com/uclouvain/openjpeg/commit/649298dcf84b2f20cfe458d887c1591db47372a6
https://github.com/uclouvain/openjpeg/commit/4ce7d285a55d29b79880d0566d4b010fe1907aa9
[jessie] - openjpeg2 <not-affected> (Vulnerable code introduced later; problem cannot be reproduced)