Patchwire CVEs, their patch status, and feeds to follow them

CVE-2020-15389

Fixed in a distro release EPSS 3%

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.

Published 2020-06-29 · CVE record · OSV

Products: uclouvain openjpeg, debian_linux, oracle outside_in_technology

Distro releases

ReleasePackageFixed in
AlmaLinux 8openjpeg22.4.0-4.el8
AlmaLinux 8openjpeg2-devel2.4.0-4.el8
AlmaLinux 8openjpeg2-devel-docs2.4.0-4.el8
AlmaLinux 8openjpeg2-tools2.4.0-4.el8
Alpine 3.10openjpeg2.3.1-r4
Alpine 3.11openjpeg2.3.1-r4
Alpine 3.12openjpeg2.3.1-r5
Alpine 3.13openjpeg2.3.1-r5
Alpine 3.14openjpeg2.3.1-r5
Alpine 3.15openjpeg2.3.1-r5
Alpine 3.16openjpeg2.3.1-r5
Alpine 3.17openjpeg2.3.1-r5
Alpine 3.18openjpeg2.3.1-r5
Alpine 3.19openjpeg2.3.1-r5
Alpine 3.20openjpeg2.3.1-r5
Alpine 3.21openjpeg2.3.1-r5
Alpine 3.22openjpeg2.3.1-r5
Alpine 3.23openjpeg2.3.1-r5
Alpine 3.24openjpeg2.3.1-r5
Alpine 3.9openjpeg2.3.0-r6
Amazon Linux 2openjpeg22.4.0-4.amzn2
Amazon Linux 2openjpeg2-devel2.4.0-4.amzn2
Amazon Linux 2openjpeg2-devel-docs2.4.0-4.amzn2
Amazon Linux 2openjpeg2-tools2.4.0-4.amzn2
Arch Linuxopenjpeg22.4.0-1
Debian 10openjpeg22.3.0-2+deb10u2
Debian 12openjpeg22.4.0-1
Debian 13openjpeg22.4.0-1
Debian 14openjpeg22.4.0-1
Debian 9openjpeg22.1.2-1.1+deb9u5
Red Hat Enterprise Linux 8openjpeg20:2.4.0-4.el8
Red Hat Enterprise Linux 8openjpeg2-debuginfo0:2.4.0-4.el8
Red Hat Enterprise Linux 8openjpeg2-debugsource0:2.4.0-4.el8
Red Hat Enterprise Linux 8openjpeg2-devel0:2.4.0-4.el8
Red Hat Enterprise Linux 8openjpeg2-devel-docs0:2.4.0-4.el8
Red Hat Enterprise Linux 8openjpeg2-tools0:2.4.0-4.el8
Red Hat Enterprise Linux 8openjpeg2-tools-debuginfo0:2.4.0-4.el8
Rocky Linux 8openjpeg20:2.4.0-4.el8
SUSE Enterprise Storage 6openjpeg1.5.2-150000.4.5.1
SUSE Enterprise Storage 6openjpeg22.3.0-150000.3.5.1
SUSE Enterprise Storage 7openjpeg1.5.2-150000.4.5.1
SUSE Enterprise Storage 7openjpeg22.3.0-150000.3.5.1
SUSE HPE Helion OpenStack 8openjpeg22.1.0-4.15.1
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOSopenjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOSopenjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSopenjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSSopenjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOSopenjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOSopenjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSopenjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSopenjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise High Performance Computing 15-ESPOSopenjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise High Performance Computing 15-ESPOSopenjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise High Performance Computing 15-LTSSopenjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise High Performance Computing 15-LTSSopenjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise Module for Basesystem 15 SP3openjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP3openjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise Module for Package Hub 15 SP3openjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise Real Time 15 SP2openjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise Real Time 15 SP2openjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise Server 12 SP2-BCLopenjpeg22.1.0-4.15.1
SUSE Linux Enterprise Server 12 SP3-BCLopenjpeg22.1.0-4.15.1
SUSE Linux Enterprise Server 12 SP3-LTSSopenjpeg22.1.0-4.15.1
SUSE Linux Enterprise Server 12 SP4-LTSSopenjpeg22.1.0-4.15.1
SUSE Linux Enterprise Server 12 SP5openjpeg22.1.0-4.15.1
SUSE Linux Enterprise Server 15 SP1-BCLopenjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise Server 15 SP1-BCLopenjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise Server 15 SP1-LTSSopenjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise Server 15 SP1-LTSSopenjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise Server 15 SP2-BCLopenjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise Server 15 SP2-BCLopenjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise Server 15 SP2-LTSSopenjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise Server 15 SP2-LTSSopenjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise Server 15-LTSSopenjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise Server 15-LTSSopenjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3openjpeg22.1.0-4.15.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4openjpeg22.1.0-4.15.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5openjpeg22.1.0-4.15.1
SUSE Linux Enterprise Server for SAP Applications 15openjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise Server for SAP Applications 15openjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1openjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1openjpeg22.3.0-150000.3.5.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2openjpeg1.5.2-150000.4.5.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2openjpeg22.3.0-150000.3.5.1
SUSE Manager Proxy 4.1openjpeg1.5.2-150000.4.5.1
SUSE Manager Proxy 4.1openjpeg22.3.0-150000.3.5.1
SUSE Manager Retail Branch Server 4.1openjpeg1.5.2-150000.4.5.1
SUSE Manager Retail Branch Server 4.1openjpeg22.3.0-150000.3.5.1
SUSE Manager Server 4.1openjpeg1.5.2-150000.4.5.1
SUSE Manager Server 4.1openjpeg22.3.0-150000.3.5.1
SUSE OpenStack Cloud 8openjpeg22.1.0-4.15.1
SUSE OpenStack Cloud 9openjpeg22.1.0-4.15.1
SUSE OpenStack Cloud Crowbar 8openjpeg22.1.0-4.15.1
SUSE OpenStack Cloud Crowbar 9openjpeg22.1.0-4.15.1
Ubuntu 16.04 LTSopenjpeg22.1.2-1.1+deb9u5build0.16.04.1
Ubuntu 18.04 LTSopenjpeg22.3.0-2+deb10u2build0.18.04.1
Ubuntu 20.04 LTSopenjpeg22.3.1-1ubuntu4.20.04.1
Ubuntu 22.04 LTSopenjpeg22.3.1-1ubuntu5
Ubuntu Pro 16.04 LTSopenjpeg22.1.2-1.1+deb9u6ubuntu0.1~esm3
openSUSE Leap 15.3openjpeg1.5.2-150000.4.5.1
openSUSE Leap 15.3openjpeg22.3.0-150000.3.5.1