CVE-2020-15389

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.
Configurations

Configuration 1 (hide)

cpe:2.3:a:uclouvain:openjpeg:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-06-29 21:15

Updated : 2024-02-28 17:47


NVD link : CVE-2020-15389

Mitre link : CVE-2020-15389

CVE.ORG link : CVE-2020-15389


JSON object : View

Products Affected

uclouvain

  • openjpeg

debian

  • debian_linux

oracle

  • outside_in_technology
CWE
CWE-416

Use After Free