Vulnerability-Lookup

RHSA-2021:4251

Vulnerability from csaf_opensuse - Published: 2021-11-09 00:00 - Updated: 2026-09-20 11:17

Summary

security update for openjpeg2

Severity

Moderate

Notes

Title of the patch: security update for openjpeg2

Description of the patch: This security update provides a functional equivalent of RHSA-2021:4251. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2021:4251.

Patchnames: RHSA-2021:4251

CVE-2018-20845

4 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 7 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2018-20847

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact moderate

CVE-2018-5727

4.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact moderate

CVE-2018-5785

4 (Medium)


                
                  CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact moderate

CVE-2019-12973

3.3 (Low)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact moderate

CVE-2020-15389

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact moderate

CVE-2020-27814

6.8 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact moderate

CVE-2020-27823

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact important

CVE-2020-27824

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact moderate

CVE-2020-27842

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact moderate

CVE-2020-27843

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact moderate

CVE-2020-27845

4.8 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact moderate

CVE-2021-29338

3.3 (Low)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact low

CVE-2021-3575

6.1 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Affected products

Recommended 7 products, the same list as for CVE-2018-20845

Threats

Impact important

References

44 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://www.suse.com/security/cve/CVE-2018-20845/	self
https://www.suse.com/security/cve/CVE-2018-20847/	self
https://www.suse.com/security/cve/CVE-2018-5727/	self
https://www.suse.com/security/cve/CVE-2018-5785/	self
https://www.suse.com/security/cve/CVE-2019-12973/	self
https://www.suse.com/security/cve/CVE-2020-15389/	self
https://www.suse.com/security/cve/CVE-2020-27814/	self
https://www.suse.com/security/cve/CVE-2020-27823/	self
https://www.suse.com/security/cve/CVE-2020-27824/	self
https://www.suse.com/security/cve/CVE-2020-27842/	self
https://www.suse.com/security/cve/CVE-2020-27843/	self
https://www.suse.com/security/cve/CVE-2020-27845/	self
https://www.suse.com/security/cve/CVE-2021-29338/	self
https://www.suse.com/security/cve/CVE-2021-3575/	self
https://www.suse.com/security/cve/CVE-2018-20845	external
https://bugzilla.suse.com/1140130	external
https://www.suse.com/security/cve/CVE-2018-20847	external
https://bugzilla.suse.com/1140220	external
https://www.suse.com/security/cve/CVE-2018-5727	external
https://bugzilla.suse.com/1076314	external
https://www.suse.com/security/cve/CVE-2018-5785	external
https://bugzilla.suse.com/1076967	external
https://www.suse.com/security/cve/CVE-2019-12973	external
https://bugzilla.suse.com/1140359	external
https://www.suse.com/security/cve/CVE-2020-15389	external
https://bugzilla.suse.com/1173578	external
https://www.suse.com/security/cve/CVE-2020-27814	external
https://bugzilla.suse.com/1179594	external
https://www.suse.com/security/cve/CVE-2020-27823	external
https://bugzilla.suse.com/1180457	external
https://www.suse.com/security/cve/CVE-2020-27824	external
https://bugzilla.suse.com/1179821	external
https://www.suse.com/security/cve/CVE-2020-27842	external
https://bugzilla.suse.com/1180043	external
https://www.suse.com/security/cve/CVE-2020-27843	external
https://bugzilla.suse.com/1180044	external
https://www.suse.com/security/cve/CVE-2020-27845	external
https://bugzilla.suse.com/1180046	external
https://www.suse.com/security/cve/CVE-2021-29338	external
https://bugzilla.suse.com/1184774	external
https://www.suse.com/security/cve/CVE-2021-3575	external
https://bugzilla.suse.com/1187048	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for openjpeg2",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2021:4251.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2021:4251.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2021:4251",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2021_4251.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20845 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20845/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-20847 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-20847/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5727 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5727/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5785 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5785/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-12973 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-12973/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-15389 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-15389/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-27814 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-27814/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-27823 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-27823/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-27824 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-27824/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-27842 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-27842/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-27843 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-27843/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-27845 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-27845/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-29338 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-29338/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-3575 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-3575/"
      }
    ],
    "title": "security update for openjpeg2",
    "tracking": {
      "current_release_date": "2026-09-20T11:17:27Z",
      "generator": {
        "date": "2021-11-09T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2021:4251",
      "initial_release_date": "2021-11-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2021-11-09T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T11:17:27Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openjpeg2-0:2.4.0-4.el8.i686",
                "product": {
                  "name": "openjpeg2-0:2.4.0-4.el8.i686",
                  "product_id": "openjpeg2-0:2.4.0-4.el8.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:uclouvain:openjpeg:2.4.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/openjpeg2@2.4.0-4.el8?arch=i686\u0026upstream=openjpeg2-0:2.4.0-4.el8.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openjpeg2-devel-0:2.4.0-4.el8.i686",
                "product": {
                  "name": "openjpeg2-devel-0:2.4.0-4.el8.i686",
                  "product_id": "openjpeg2-devel-0:2.4.0-4.el8.i686",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:uclouvain:openjpeg:2.4.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/openjpeg2-devel@2.4.0-4.el8?arch=i686\u0026upstream=openjpeg2-0:2.4.0-4.el8.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openjpeg2-tools-0:2.4.0-4.el8.i686",
                "product": {
                  "name": "openjpeg2-tools-0:2.4.0-4.el8.i686",
                  "product_id": "openjpeg2-tools-0:2.4.0-4.el8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/openjpeg2-tools@2.4.0-4.el8?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
                "product": {
                  "name": "openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
                  "product_id": "openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/openjpeg2-devel-docs@2.4.0-4.el8?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openjpeg2-0:2.4.0-4.el8.x86_64",
                "product": {
                  "name": "openjpeg2-0:2.4.0-4.el8.x86_64",
                  "product_id": "openjpeg2-0:2.4.0-4.el8.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:uclouvain:openjpeg:2.4.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/openjpeg2@2.4.0-4.el8?arch=x86_64\u0026upstream=openjpeg2-0:2.4.0-4.el8.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openjpeg2-devel-0:2.4.0-4.el8.x86_64",
                "product": {
                  "name": "openjpeg2-devel-0:2.4.0-4.el8.x86_64",
                  "product_id": "openjpeg2-devel-0:2.4.0-4.el8.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:uclouvain:openjpeg:2.4.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/openjpeg2-devel@2.4.0-4.el8?arch=x86_64\u0026upstream=openjpeg2-0:2.4.0-4.el8.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openjpeg2-tools-0:2.4.0-4.el8.x86_64",
                "product": {
                  "name": "openjpeg2-tools-0:2.4.0-4.el8.x86_64",
                  "product_id": "openjpeg2-tools-0:2.4.0-4.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/openjpeg2-tools@2.4.0-4.el8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 8",
                "product": {
                  "name": "SUSE Liberty Linux 8",
                  "product_id": "SUSE Liberty Linux 8",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openjpeg2-0:2.4.0-4.el8.i686 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686"
        },
        "product_reference": "openjpeg2-0:2.4.0-4.el8.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openjpeg2-0:2.4.0-4.el8.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64"
        },
        "product_reference": "openjpeg2-0:2.4.0-4.el8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openjpeg2-devel-0:2.4.0-4.el8.i686 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686"
        },
        "product_reference": "openjpeg2-devel-0:2.4.0-4.el8.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openjpeg2-devel-0:2.4.0-4.el8.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64"
        },
        "product_reference": "openjpeg2-devel-0:2.4.0-4.el8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openjpeg2-devel-docs-0:2.4.0-4.el8.noarch as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch"
        },
        "product_reference": "openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openjpeg2-tools-0:2.4.0-4.el8.i686 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686"
        },
        "product_reference": "openjpeg2-tools-0:2.4.0-4.el8.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openjpeg2-tools-0:2.4.0-4.el8.x86_64 as component of SUSE Liberty Linux 8",
          "product_id": "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        },
        "product_reference": "openjpeg2-tools-0:2.4.0-4.el8.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-20845",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20845"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20845",
          "url": "https://www.suse.com/security/cve/CVE-2018-20845"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1140130 for CVE-2018-20845",
          "url": "https://bugzilla.suse.com/1140130"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20845"
    },
    {
      "cve": "CVE-2018-20847",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-20847"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An improper computation of p_tx0, p_tx1, p_ty0 and p_ty1 in the function opj_get_encoding_parameters in openjp2/pi.c in OpenJPEG through 2.3.0 can lead to an integer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-20847",
          "url": "https://www.suse.com/security/cve/CVE-2018-20847"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1140220 for CVE-2018-20847",
          "url": "https://bugzilla.suse.com/1140220"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-20847"
    },
    {
      "cve": "CVE-2018-5727",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5727"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In OpenJPEG 2.3.0, there is an integer overflow vulnerability in the opj_t1_encode_cblks function (openjp2/t1.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5727",
          "url": "https://www.suse.com/security/cve/CVE-2018-5727"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1076314 for CVE-2018-5727",
          "url": "https://bugzilla.suse.com/1076314"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5727"
    },
    {
      "cve": "CVE-2018-5785",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5785"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In OpenJPEG 2.3.0, there is an integer overflow caused by an out-of-bounds left shift in the opj_j2k_setup_encoder function (openjp2/j2k.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5785",
          "url": "https://www.suse.com/security/cve/CVE-2018-5785"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1076967 for CVE-2018-5785",
          "url": "https://bugzilla.suse.com/1076967"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5785"
    },
    {
      "cve": "CVE-2019-12973",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-12973"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp file. This issue is similar to CVE-2018-6616.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-12973",
          "url": "https://www.suse.com/security/cve/CVE-2019-12973"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1140359 for CVE-2019-12973",
          "url": "https://bugzilla.suse.com/1140359"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-12973"
    },
    {
      "cve": "CVE-2020-15389",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-15389"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-15389",
          "url": "https://www.suse.com/security/cve/CVE-2020-15389"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1173578 for CVE-2020-15389",
          "url": "https://bugzilla.suse.com/1173578"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-15389"
    },
    {
      "cve": "CVE-2020-27814",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-27814"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-27814",
          "url": "https://www.suse.com/security/cve/CVE-2020-27814"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179594 for CVE-2020-27814",
          "url": "https://bugzilla.suse.com/1179594"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-27814"
    },
    {
      "cve": "CVE-2020-27823",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-27823"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenJPEG\u0027s encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-27823",
          "url": "https://www.suse.com/security/cve/CVE-2020-27823"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180457 for CVE-2020-27823",
          "url": "https://bugzilla.suse.com/1180457"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-27823"
    },
    {
      "cve": "CVE-2020-27824",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-27824"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenJPEG\u0027s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-27824",
          "url": "https://www.suse.com/security/cve/CVE-2020-27824"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179821 for CVE-2020-27824",
          "url": "https://bugzilla.suse.com/1179821"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-27824"
    },
    {
      "cve": "CVE-2020-27842",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-27842"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There\u0027s a flaw in openjpeg\u0027s t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-27842",
          "url": "https://www.suse.com/security/cve/CVE-2020-27842"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180043 for CVE-2020-27842",
          "url": "https://bugzilla.suse.com/1180043"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-27842"
    },
    {
      "cve": "CVE-2020-27843",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-27843"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-27843",
          "url": "https://www.suse.com/security/cve/CVE-2020-27843"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180044 for CVE-2020-27843",
          "url": "https://bugzilla.suse.com/1180044"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-27843"
    },
    {
      "cve": "CVE-2020-27845",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-27845"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "There\u0027s a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg\u0027s conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-27845",
          "url": "https://www.suse.com/security/cve/CVE-2020-27845"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1180046 for CVE-2020-27845",
          "url": "https://bugzilla.suse.com/1180046"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2020-27845"
    },
    {
      "cve": "CVE-2021-29338",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-29338"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option \"-ImgDir\" on a directory that contains 1048576 files.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-29338",
          "url": "https://www.suse.com/security/cve/CVE-2021-29338"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1184774 for CVE-2021-29338",
          "url": "https://bugzilla.suse.com/1184774"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "low"
        }
      ],
      "title": "CVE-2021-29338"
    },
    {
      "cve": "CVE-2021-3575",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-3575"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
          "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
          "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-3575",
          "url": "https://www.suse.com/security/cve/CVE-2021-3575"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1187048 for CVE-2021-3575",
          "url": "https://bugzilla.suse.com/1187048"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-devel-0:2.4.0-4.el8.x86_64",
            "SUSE Liberty Linux 8:openjpeg2-devel-docs-0:2.4.0-4.el8.noarch",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.i686",
            "SUSE Liberty Linux 8:openjpeg2-tools-0:2.4.0-4.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2021-11-09T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-3575"
    }
  ]
}

CVE-2020-27843 (GCVE-0-2020-27843)

Vulnerability from cvelistv5 – Published: 2021-01-05 17:22 – Updated: 2024-08-04 16:25

Summary

A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability.

Severity

No CVSS data available.

CWE

CWE-125

Assigner

redhat redhat root

References

7 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1907516	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.gentoo.org/glsa/202101-29	vendor-advisoryx_refsource_GENTOO
https://www.debian.org/security/2021/dsa-4882	vendor-advisoryx_refsource_DEBIAN
https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2022…	mailing-listx_refsource_MLIST

Impacted products

1 product

Vendor	Product	Version
n/a	openjpeg	Affected: openjpeg 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:25:43.322Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907516"
          },
          {
            "name": "FEDORA-2020-d32853a28d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/"
          },
          {
            "name": "GLSA-202101-29",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-29"
          },
          {
            "name": "DSA-4882",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4882"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "name": "[debian-lts-announce] 20220410 [SECURITY] [DLA 2975-1] openjpeg2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openjpeg",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "openjpeg 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-10T14:06:07.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907516"
        },
        {
          "name": "FEDORA-2020-d32853a28d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/"
        },
        {
          "name": "GLSA-202101-29",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-29"
        },
        {
          "name": "DSA-4882",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4882"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "name": "[debian-lts-announce] 20220410 [SECURITY] [DLA 2975-1] openjpeg2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2020-27843",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "openjpeg",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "openjpeg 2.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-125"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1907516",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907516"
            },
            {
              "name": "FEDORA-2020-d32853a28d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/"
            },
            {
              "name": "GLSA-202101-29",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-29"
            },
            {
              "name": "DSA-4882",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4882"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "[debian-lts-announce] 20220410 [SECURITY] [DLA 2975-1] openjpeg2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-27843",
    "datePublished": "2021-01-05T17:22:06.000Z",
    "dateReserved": "2020-10-27T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:25:43.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-27845 (GCVE-0-2020-27845)

Vulnerability from cvelistv5 – Published: 2021-01-05 17:44 – Updated: 2024-08-04 16:25

Summary

There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability.

Severity

No CVSS data available.

CWE

CWE-125

Assigner

redhat redhat root

References

7 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1907523	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://security.gentoo.org/glsa/202101-29	vendor-advisoryx_refsource_GENTOO
https://lists.debian.org/debian-lts-announce/2021…	mailing-listx_refsource_MLIST
https://www.debian.org/security/2021/dsa-4882	vendor-advisoryx_refsource_DEBIAN
https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	openjpeg	Affected: openjpeg 2.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:25:43.862Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907523"
          },
          {
            "name": "FEDORA-2020-d32853a28d",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/"
          },
          {
            "name": "GLSA-202101-29",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-29"
          },
          {
            "name": "[debian-lts-announce] 20210208 [SECURITY] [DLA 2550-1] openjpeg2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html"
          },
          {
            "name": "DSA-4882",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4882"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openjpeg",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "openjpeg 2.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There\u0027s a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg\u0027s conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-20T22:54:55.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907523"
        },
        {
          "name": "FEDORA-2020-d32853a28d",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/"
        },
        {
          "name": "GLSA-202101-29",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-29"
        },
        {
          "name": "[debian-lts-announce] 20210208 [SECURITY] [DLA 2550-1] openjpeg2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html"
        },
        {
          "name": "DSA-4882",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4882"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2020-27845",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "openjpeg",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "openjpeg 2.4.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "There\u0027s a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg\u0027s conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-125"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1907523",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1907523"
            },
            {
              "name": "FEDORA-2020-d32853a28d",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/"
            },
            {
              "name": "GLSA-202101-29",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-29"
            },
            {
              "name": "[debian-lts-announce] 20210208 [SECURITY] [DLA 2550-1] openjpeg2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html"
            },
            {
              "name": "DSA-4882",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4882"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-27845",
    "datePublished": "2021-01-05T17:44:30.000Z",
    "dateReserved": "2020-10-27T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:25:43.862Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-29338 (GCVE-0-2021-29338)

Vulnerability from cvelistv5 – Published: 2021-04-14 13:52 – Updated: 2025-11-03 19:25

Summary

Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option "-ImgDir" on a directory that contains 1048576 files.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

6 references

URL	Tags
https://github.com/uclouvain/openjpeg/issues/1338	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.debian.org/debian-lts-announce/2022…	mailing-listx_refsource_MLIST
https://security.gentoo.org/glsa/202209-04	vendor-advisoryx_refsource_GENTOO
https://lists.debian.org/debian-lts-announce/2025…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:25:43.869Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/uclouvain/openjpeg/issues/1338"
          },
          {
            "name": "FEDORA-2021-c1ac2ee5ee",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ54FGM2IGAP4AWSJ22JKHOPHCR3FGYU/"
          },
          {
            "name": "FEDORA-2021-e145f477df",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB6AI7CWXWMEDZIQY4LQ6DMIEXMDOHUP/"
          },
          {
            "name": "[debian-lts-announce] 20220410 [SECURITY] [DLA 2975-1] openjpeg2 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html"
          },
          {
            "name": "GLSA-202209-04",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202209-04"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option \"-ImgDir\" on a directory that contains 1048576 files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-09-07T04:06:30.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/uclouvain/openjpeg/issues/1338"
        },
        {
          "name": "FEDORA-2021-c1ac2ee5ee",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ54FGM2IGAP4AWSJ22JKHOPHCR3FGYU/"
        },
        {
          "name": "FEDORA-2021-e145f477df",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB6AI7CWXWMEDZIQY4LQ6DMIEXMDOHUP/"
        },
        {
          "name": "[debian-lts-announce] 20220410 [SECURITY] [DLA 2975-1] openjpeg2 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html"
        },
        {
          "name": "GLSA-202209-04",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202209-04"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-29338",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). This occurs when the attacker uses the command line option \"-ImgDir\" on a directory that contains 1048576 files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/uclouvain/openjpeg/issues/1338",
              "refsource": "MISC",
              "url": "https://github.com/uclouvain/openjpeg/issues/1338"
            },
            {
              "name": "FEDORA-2021-c1ac2ee5ee",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZ54FGM2IGAP4AWSJ22JKHOPHCR3FGYU/"
            },
            {
              "name": "FEDORA-2021-e145f477df",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB6AI7CWXWMEDZIQY4LQ6DMIEXMDOHUP/"
            },
            {
              "name": "[debian-lts-announce] 20220410 [SECURITY] [DLA 2975-1] openjpeg2 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html"
            },
            {
              "name": "GLSA-202209-04",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202209-04"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-29338",
    "datePublished": "2021-04-14T13:52:26.000Z",
    "dateReserved": "2021-03-29T00:00:00.000Z",
    "dateUpdated": "2025-11-03T19:25:43.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-3575 (GCVE-0-2021-3575)

Vulnerability from cvelistv5 – Published: 2022-03-04 17:20 – Updated: 2025-11-03 19:25

Summary

A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.

Severity

No CVSS data available.

CWE

CWE-787

Assigner

redhat redhat root

References

6 references

URL	Tags
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://bugzilla.redhat.com/show_bug.cgi?id=1957616	x_refsource_MISC
https://github.com/uclouvain/openjpeg/issues/1347	x_refsource_MISC
https://ubuntu.com/security/CVE-2021-3575	x_refsource_MISC
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
n/a	OpenJPEG	Affected: Afeects v2.4.0 and prior.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:25:50.833Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "FEDORA-2021-c1ac2ee5ee",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ54FGM2IGAP4AWSJ22JKHOPHCR3FGYU/"
          },
          {
            "name": "FEDORA-2021-e145f477df",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB6AI7CWXWMEDZIQY4LQ6DMIEXMDOHUP/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1957616"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/uclouvain/openjpeg/issues/1347"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ubuntu.com/security/CVE-2021-3575"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenJPEG",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Afeects v2.4.0 and prior."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-05-23T18:15:25.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "FEDORA-2021-c1ac2ee5ee",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZ54FGM2IGAP4AWSJ22JKHOPHCR3FGYU/"
        },
        {
          "name": "FEDORA-2021-e145f477df",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QB6AI7CWXWMEDZIQY4LQ6DMIEXMDOHUP/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1957616"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/uclouvain/openjpeg/issues/1347"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ubuntu.com/security/CVE-2021-3575"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3575",
    "datePublished": "2022-03-04T17:20:40.000Z",
    "dateReserved": "2021-06-02T00:00:00.000Z",
    "dateUpdated": "2025-11-03T19:25:50.833Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2021:4251

CVE-2020-27843 (GCVE-0-2020-27843)

CVE-2020-27845 (GCVE-0-2020-27845)

CVE-2021-29338 (GCVE-0-2021-29338)

CVE-2021-3575 (GCVE-0-2021-3575)

Tags

Sightings

Nomenclature

Related by attack behaviour