Open mend-bolt-for-github[bot] opened 3 years ago
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
CVE-2020-27844 - High Severity Vulnerability
Vulnerable Library - openjpegv2.3.0
Official repository of the OpenJPEG project
Library home page: https://github.com/uclouvain/openjpeg.git
Found in HEAD commit: 3501163dd1d68645efcce586f29683574a46c95f
Found in base branch: master
Vulnerable Source Files (1)
Vulnerability Details
A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Publish Date: 2021-01-05
URL: CVE-2020-27844
CVSS 3 Score Details (7.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/202101-29
Fix Resolution: All OpenJPEG 2 users should upgrade to the latest version # emerge --sync # emerge --ask --oneshot --verbose >=media-libs/openjpeg-2.4.02 Gentoo has discontinued support OpenJPEG 1.x and any dependent packages should now be using OpenJPEG 2 or have dropped support for the library. We recommend that users unmerge OpenJPEG 1.x # emerge --unmerge media-libs/openjpeg1 >=
Step up your Open Source Security Game with Mend here