Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.0440
openjpeg2 security update
9 February 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: openjpeg2
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-27845 CVE-2020-27844 CVE-2020-27841
CVE-2020-27824 CVE-2020-27823 CVE-2020-27814
Reference: ESB-2021.0085
ESB-2021.0084
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- - -------------------------------------------------------------------------
Debian LTS Advisory DLA-2550-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Brian May
February 09, 2021 https://wiki.debian.org/LTS
- - -------------------------------------------------------------------------
Package : openjpeg2
Version : 2.1.2-1.1+deb9u6
CVE ID : CVE-2020-27814 CVE-2020-27823 CVE-2020-27824 CVE-2020-27841
CVE-2020-27844 CVE-2020-27845
Various overflow errors were identified and fixed.
CVE-2020-27814
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files.
CVE-2020-27823
Wrong computation of x1,y1 if -d option is used, resulting in heap buffer
overflow.
CVE-2020-27824
Global buffer overflow on irreversible conversion when too many
decomposition levels are specified.
CVE-2020-27841
Crafted input to be processed by the openjpeg encoder could cause an
out-of-bounds read.
CVE-2020-27844
Crafted input to be processed by the openjpeg encoder could cause an
out-of-bounds write.
CVE-2020-27845
Crafted input can cause out-of-bounds-read.
For Debian 9 stretch, these problems have been fixed in version
2.1.2-1.1+deb9u6.
We recommend that you upgrade your openjpeg2 packages.
For the detailed security status of openjpeg2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openjpeg2
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEKpwfR8DOwu5vyB4TKpJZkldkSvoFAmAhtQcACgkQKpJZkldk
SvrZcw/8DbSP6wWmlild41IgRroquPaY0DAorg59xGhZZLWJ19HYEJ0O1XNc8edV
rgolb9B8o96//kzzUJ/UABEOPNVTbacfDnUDNiAtry/4fPjmfa9Qg4iaarLFNFpb
QfMnDFTFPYP1HToIAWVkJT6S4U5A2V35Mhqo2GrHz3cwoz2uLYrZx14iLuZWFO3h
OpNJmAv3IyH3qOUTccgaUiWfFkDZOA2wI+BgvI7nDmLeuqfCFdJ9XMBGEz3FRMH9
uOJRGbIXrY7yyDNLwG+qYsa6btaxDwfPyXZHYiC73N2T24yaboDFQt3l0mzKNheu
gUi1X6K7ICjKp4/8+o0XsM1VVQsiyg9KckxM5thhLtgmTdJ+wc/NFRy3JOtj8r04
VUoQDi3rs5NOW9MV6YswD3DeRd8EkYay5sJ6r13TGAViNDZPtj1EJt7bfnRwcD1G
5N756jZWjHcc0k/u/egeG/1u9S0uXTr+Dhy+vFR/8gojb/a5vtI/iMWLccRlB0Qc
UNl/Xtcwy283trleBfUpIcnc3g4kjLnWtHjEOX+G1o986/bL6DVO32fQou/hi/Nn
w6hIH9wr1aSFbyb4NznpKLW8PZEPsseli9eD4/zL4LCRLdGCBnRNq1+xj+RS5NCz
c50ROdoWPW3nz5Y+NhAspQjzH24Jg5cvrX0pX7G3a2g8WYP/Ei8=
=LFai
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYCIimeNLKJtyKPYoAQiQWhAAkRdewzasGcfB6PT/984GSgP0rs2yLFAW
SeqY+aJh4Gf18EK6v4hay3XhENsi4qh8MSTfe2D5+gJ5cGhBkQOHQnLI3+zeRPUM
Tbqmao2n8lhr5BfL++D4G6/yTwSiBnNmuCmf0HkwomOgdbaF2evEjnrHMohgro6X
v5/MQJ6bK2SAogGPdGrTQnsEz0SIcbogxifj3VF+XqoHtAI15/9W6tuqKbuR3JIJ
ZZ3ERx0aPj5FdarPIQwHc7ULjPC7LyccjVfdkKDvsFogd2wsJ5hcBvC8UBBzsA21
rfLgprBE5JFofbKqAbOapm43uCYYhibR/shwwSpMRbcX1NYXWlMFsTgT3MD6x096
6JF7CJhlHR9y6M0YaJf0uzWYeYEbc0QKtYYHRtVpv6zDxr6S+N+wDWdUf9VF5bOg
74yXvqakuQW8lZJ+u6I2+Kok2tmOGNbfXi606k+1v5i592kL45/nEGP68/xSDJYV
DfTR3TMMNzD8DLw+83hzZ8GKiC46bivcxSDPZzt5XWE6hYRbLx2xdRuovYeKkHXJ
XlLSCw3V4gQUl+0O8GxOwbXrWu/HLi11vo2CrnxWg1TXdjs6TP4Z0hFazOlVreM+
YDfxAxV/FpOz3iri2lpOS+/4NyZl6n/6LEOFKzt86HQmbYqlGsAxyAXnhfzvGPj2
nHQFUqe2ANU=
=63L5
-----END PGP SIGNATURE-----