Description
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.
References (6)
Core 6
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1901998
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/uclouvain/openjpeg/issues/1283
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/202101-29
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
Third Party Advisory vendor-advisory
x_refsource_debian
https://www.debian.org/security/2021/dsa-4882
Third Party Advisory x_refsource_misc
https://www.oracle.com//security-alerts/cpujul2021.html
Scores
CVSS v3
7.8
EPSS
0.0022
EPSS Percentile
44.7%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CWE
CWE-122
Status
published
Products (3)
debian/debian_linux
9.0
debian/debian_linux
10.0
uclouvain/openjpeg
< 1.5.1
Published
Jan 26, 2021
Tracked Since
Feb 18, 2026