CVE-2020-6851

HIGH7.5EPSS 4.8%

openjpeg2 - security update

Published: 1/13/2020Modified: 12/3/2025

Also known as:ALPINE-CVE-2020-6851

Description

OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.

Affected packages (3)

Alpine/openjpegfrom 0, < 2.3.1-r3
Debian/openjpeg2from 0, < 2.4.0-1
Debian/openjpeg2from 0, < 2.1.0-2+deb8u9

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2020-6851
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-6851