Heap-based Buffer Overflow

Affecting openjpeg2 package, versions <2.1.2-1.1+deb9u6

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

Affected versions of this package are vulnerable to Heap-based Buffer Overflow. A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.

Remediation

Upgrade openjpeg2 to version or higher.

References

CVSS Score

7.8
high severity
  • Attack Vector
    Local
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    Required
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    High
  • Availability
    High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE
CVE-2020-27814
CWE
CWE-122
Snyk ID
SNYK-DEBIAN9-OPENJPEG2-1047354
Disclosed
26 Jan, 2021
Published
30 Nov, 2020