CVE-2020-27842

Common vulnerabilities & exposures (CVE)

CVE database CVE database blogpost Release & EoL database

Published at: - 05-01-2021 07:15

Last modified: - 14-06-2022 04:38

Total changes: - 11

Description

There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Low

Attack complexity

Local

Attack vector

High

Availability

None

Confidentiality

None

Integrity

None

Privileges required

Unchanged

Scope

Required

User interaction

5.5

Base score

1.8

3.6

Exploitability score

Impact score

Verification logic

vendor=uclouvain AND product=openjpeg AND versionEndExcluding=2.4.0

vendor=fedoraproject AND product=fedora AND version=32

vendor=fedoraproject AND product=fedora AND version=33

vendor=fedoraproject AND product=extra_packages_for_enterprise_linux AND version=7.0

vendor=Debian AND product=debian_linux AND version=9.0

vendor=Debian AND product=debian_linux AND version=10.0

vendor=Red Hat Enterprise Linux AND product=enterprise_linux AND version=8.0

vendor=Red Hat Enterprise Linux AND product=enterprise_linux_for_power_little_endian AND version=8.0

vendor=Red Hat Enterprise Linux AND product=enterprise_linux_for_ibm_z_systems AND version=8.0

vendor=Red Hat Enterprise Linux AND product=codeready_linux_builder_for_ibm_z_systems AND version=8.0

vendor=Red Hat Enterprise Linux AND product=codeready_linux_builder AND version=8.0

vendor=Red Hat Enterprise Linux AND product=codeready_linux_builder_for_power_little_endian AND version=8.0

vendor=oracle AND product=outside_in_technology AND version=8.5.5

Reference

https://bugzilla.redhat.com/show_bug.cgi?id=1907513
FEDORA-2020-d32853a28d-Third Party Advisory
GLSA-202101-29-Third Party Advisory
DSA-4882-Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html
N/A-Patch, Third Party Advisory
[debian-lts-announce] 20220410 [SECURITY] [DLA 2975-1] openjpeg2 security update-Mailing List, Third Party Advisory

Keywords

CVE-2020-27842

Common vulnerabilities & exposures (CVE)

Description

Common Vulnerability Scoring System (CVSS)

Verification logic

Reference

NVD

CVE-2020-27842

CVE

Common vulnerabilities & exposures

CVSS

Common vulnerability scoring system

Security

Vulnerabilities

Exposures