Vulnerability of OpenJPEG: buffer overflow via opj_dwt_calc_explicit_stepsizes

Synthesis of the vulnerability

An attacker can trigger a buffer overflow via opj_dwt_calc_explicit_stepsizes() of OpenJPEG, in order to trigger a denial of service, and possibly to run code.

Impacted software: Debian, Fedora, Ubuntu.

Severity of this computer vulnerability: 2/4.

Creation date: 16/12/2020.

Références of this announce: CVE-2020-27824, DLA-2550-1, DSA-4882-1, FEDORA-2020-4cd57a6876, FEDORA-2020-d32853a28d, USN-4685-1, USN-4686-1, USN-4880-1, VIGILANCE-VUL-34132.

Description of the vulnerability

An attacker can trigger a buffer overflow via opj_dwt_calc_explicit_stepsizes() of OpenJPEG, in order to trigger a denial of service, and possibly to run code.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This computer threat impacts software or systems such as Debian, Fedora, Ubuntu.

Our Vigil@nce team determined that the severity of this computer vulnerability alert is medium.

The trust level is of type confirmed by the editor, with an origin of document.

An attacker with a expert ability can exploit this cybersecurity weakness.

Solutions for this threat

Debian 10: new openjpeg2 packages.
New packages are available:
Debian 10: openjpeg2 2.3.0-2+deb10u2

Debian 9: new openjpeg2 packages.
New packages are available:
Debian 9: openjpeg2 2.1.2-1.1+deb9u6

Fedora 32: new mingw-openjpeg2 packages.
New packages are available:
Fedora 32: mingw-openjpeg2 2.3.1-11.fc32

Fedora 32: new openjpeg2 packages.
New packages are available:
Fedora 32: openjpeg2 2.3.1-10.fc32

Fedora 33: new mingw-openjpeg2 packages.
New packages are available:
Fedora 33: mingw-openjpeg2 2.3.1-10.fc33

Fedora 33: new openjpeg2 packages.
New packages are available:
Fedora 33: openjpeg2 2.3.1-9.fc33

Ubuntu 16.04: new libopenjp packages.
New packages are available:
Ubuntu 16.04 LTS: libopenjp2-7 2.1.2-1.1+deb9u6build0.16.04.1, libopenjp3d7 2.1.2-1.1+deb9u6build0.16.04.1, libopenjpip7 2.1.2-1.1+deb9u6build0.16.04.1

Ubuntu: new ghostscript packages.
New packages are available:
Ubuntu 18.04 LTS: ghostscript 9.26~dfsg+0-0ubuntu0.18.04.14
Ubuntu 16.04 LTS: ghostscript 9.26~dfsg+0-0ubuntu0.16.04.14

Ubuntu: new libopenjp packages.
New packages are available:
Ubuntu 20.10: libopenjp 2.3.1-1ubuntu4.20.10.1
Ubuntu 20.04 LTS: libopenjp 2.3.1-1ubuntu4.20.04.1
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service

Vigil@nce provides computer vulnerability analysis. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.