CVE-2020-15389

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-15389
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-15389.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2020-15389
Downstream
ALPINE (1)
ALSA (1)
AZL (1)
BELL (1)
CLEANSTART (1)
DEBIAN (1)
JLSEC (1)
MGASA (1)
openSUSE (1)
RHSA (1)
RLSA (1)
SUSE (3)
UBUNTU (1)
Related
ALSA (1)
openSUSE (1)
SUSE (3)
Published
2020-06-29T21:15:14Z
Modified
2026-10-16T02:47:42Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H CVSS Calculator
Summary
[none]
Details

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "9.0"
                        },
                        {
                            "last_affected": "9.0"
                        },
                        {
                            "introduced": "10.0"
                        },
                        {
                            "last_affected": "10.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "debian:debian_linux"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "8.5.4"
                        },
                        {
                            "last_affected": "8.5.4"
                        },
                        {
                            "introduced": "8.5.5"
                        },
                        {
                            "last_affected": "8.5.5"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "oracle:outside_in_technology"
        }
    ]
}
References

Affected packages

Git / github.com/uclouvain/openjpeg

Affected ranges

Type
GIT
Repo
https://github.com/uclouvain/openjpeg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
57096325457f96d8cd07bd3af04fe81d7a2ba788
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:uclouvain:openjpeg:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "2.3.1"
                }
            ],
            "source": "CPE_RANGE"
        }
    ]
}

Affected versions

v2.*
v2.2.0
v2.3.0
v2.3.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-15389.json"