CVE-2020-15389

MEDIUM6.5EPSS 0.72%

openjpeg2 - security update

發布日:2020/6/29修改日:2026/4/28

也稱為:DSA-4882-1ALPINE-CVE-2020-15389DEBIAN-CVE-2020-15389DEBIAN-CVE-2020-6851DEBIAN-CVE-2020-8112

描述

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.

受影響套件(3)

Alpine/openjpegfrom 0, < 2.3.1-r4
Debian/openjpeg2from 0, < 2.4.0-1
Debian/openjpeg2from 0, < 2.3.0-2+deb10u2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

參考連結(2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2020-15389
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-15389