jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can
be triggered if there is a mix of valid and invalid files in a directory
operated on by the decompressor.
Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.
For Debian 8 jessie, these problems have been fixed in version 2.1.0-2+deb8u11.
We recommend that you upgrade your openjpeg2 packages.
Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/