ELA-241-1 openjpeg2 security update

use-after-free and double-free in openjpeg2

2020-07-13
Packageopenjpeg2
Version2.1.0-2+deb8u11
Related CVEs CVE-2020-15389


jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor.
Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.



For Debian 8 jessie, these problems have been fixed in version 2.1.0-2+deb8u11.

We recommend that you upgrade your openjpeg2 packages.

Further information about Extended LTS security advisories can be found in the dedicated section of our website.