CVE-2020-27842
published 2021-01-05CVE-2020-27842: There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a…
PriorityP422medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
1.52%
74.4th percentile
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | openjpeg2 | < openjpeg2 2.4.0-1 (bookworm) | openjpeg2 2.4.0-1 (bookworm) |
| fedoraproject | extra_packages_for_enterprise_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | azl3_openjpeg2_2.3.1-12_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| oracle | outside_in_technology | — | — |
| redhat | codeready_linux_builder | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems | — | — |
| redhat | codeready_linux_builder_for_power_little_endian | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.4.0-1 | 2.4.0-1 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.4.0-1 | 2.4.0-1 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.4.0-1 | 2.4.0-1 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.4.0-1 | 2.4.0-1 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.3.0-2+deb10u2build0.18.04.1 | 2.3.0-2+deb10u2build0.18.04.1 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.1.2-1.1+deb9u6ubuntu0.1~esm3 | 2.1.2-1.1+deb9u6ubuntu0.1~esm3 |
| uclouvain | openjpeg | < 2.4.0 | 2.4.0 |
| uclouvain | openjpeg | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv6.5MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_oracle5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
OpenJPEG vulnerabilities
vendor_ubuntu·2023-03-15·CVSS 6.5
CVE-2020-27814 [MEDIUM] OpenJPEG vulnerabilities
Title: OpenJPEG vulnerabilities
Summary: Several security issues were fixed in OpenJPEG.
Sebastian Poeplau discovered that OpenJPEG incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu 18.04
LTS. (CVE-2020-6851, CVE-2020-8112)
It was discovered that OpenJPEG incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2020-15389, CVE-2020-27814, CVE-2020-27823, CVE-2
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Installation (OpenJPEG) — CVE-2020-27842
vendor_oracle·2021-04-15·CVSS 5.5
CVE-2020-27842 [MEDIUM] Oracle Oracle Fusion Middleware Risk Matrix: Installation (OpenJPEG) — CVE-2020-27842
Oracle Oracle Fusion Middleware Risk Matrix: Installation (OpenJPEG) vulnerability
CVE: CVE-2020-27842
CVSS: 5.5
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuapr2021 (APR 2021)
Microsoft
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest imp
vendor_msrc·2021-01-12·CVSS 5.5
CVE-2020-27842 [MEDIUM] CWE-125 There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest imp
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to addit
Ubuntu
Ghostscript vulnerabilities
vendor_ubuntu·2021-01-07
CVE-2020-27842 Ghostscript vulnerabilities
Title: Ghostscript vulnerabilities
Summary: Several security issues were fixed in Ghostscript.
It was discovered that Ghostscript incorrectly handled certain image
files. If a user or automated system were tricked into processing a
specially crafted file, a remote attacker could use this issue to cause
Ghostscript to crash, resulting in a denial of service, or possibly
execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
OpenJPEG vulnerabilities
vendor_ubuntu·2021-01-07
CVE-2020-27842 OpenJPEG vulnerabilities
Title: OpenJPEG vulnerabilities
Summary: Several security issues were fixed in OpenJPEG.
It was discovered that OpenJPEG incorrectly handled certain image data. An
attacker could use this issue to cause OpenJPEG to crash, leading to a
denial of service, or possibly execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
openjpeg: null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c
vendor_redhat·2020-12-01·CVSS 5.5
CVE-2020-27842 [MEDIUM] CWE-125 openjpeg: null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c
openjpeg: null pointer dereference in opj_tgt_reset function in lib/openjp2/tgt.c
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.
A flaw was found in OpenJPEG’s t2 encoder. This flaw allows an attacker who can provide crafted input to be processed by OpenJPEG to cause a NULL pointer dereference issue. The highest threat to this vulnerability is to system availability.
Package: openjpeg (Red Hat Enterprise Linux 6) - Out of support scope
Package: openjpeg (Red Hat Enterprise Linux 7) - Out of support scope
Package: openjpeg2 (Red Hat Enterprise Linux 7) - Out of support scope
Debian
CVE-2020-27842: openjpeg2 - There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker ...
vendor_debian·2020·CVSS 5.5
CVE-2020-27842 [MEDIUM] CVE-2020-27842: openjpeg2 - There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker ...
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.
Scope: local
bookworm: resolved (fixed in 2.4.0-1)
bullseye: resolved (fixed in 2.4.0-1)
forky: resolved (fixed in 2.4.0-1)
sid: resolved (fixed in 2.4.0-1)
trixie: resolved (fixed in 2.4.0-1)
OSV
openjpeg2 vulnerabilities
osv·2023-03-15·CVSS 6.5
CVE-2020-6851 [MEDIUM] openjpeg2 vulnerabilities
openjpeg2 vulnerabilities
Sebastian Poeplau discovered that OpenJPEG incorrectly handled certain inputs.
If a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a denial
of service or execute arbitrary code. This issue only affected Ubuntu 18.04
LTS. (CVE-2020-6851, CVE-2020-8112)
It was discovered that OpenJPEG incorrectly handled certain inputs. If a user
or an automated system were tricked into opening a specially crafted input
file, a remote attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS.
(CVE-2020-15389, CVE-2020-27814, CVE-2020-27823, CVE-2020-27824,
CVE-2020-27841, CVE-2020-27845)
It was discovered th
GHSA
GHSA-f46j-qjjj-q5vh: There's a flaw in openjpeg's t2 encoder in versions prior to 2
ghsa_unreviewed·2022-05-24
CVE-2020-27842 [MEDIUM] CWE-125 GHSA-f46j-qjjj-q5vh: There's a flaw in openjpeg's t2 encoder in versions prior to 2
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.
OSV
CVE-2020-27842: There's a flaw in openjpeg's t2 encoder in versions prior to 2
osv·2021-01-05·CVSS 5.5
CVE-2020-27842 [MEDIUM] CVE-2020-27842: There's a flaw in openjpeg's t2 encoder in versions prior to 2
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1907513https://lists.debian.org/debian-lts-announce/2022/04/msg00006.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/https://security.gentoo.org/glsa/202101-29https://www.debian.org/security/2021/dsa-4882https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1907513https://lists.debian.org/debian-lts-announce/2022/04/msg00006.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/https://security.gentoo.org/glsa/202101-29https://www.debian.org/security/2021/dsa-4882https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.html
2021-01-05
Published