CVE-2020-27842 Null dereference in openjpeg
An attacker can cause a denial of service in applications using OpenJPEG by providing crafted input that triggers a null pointer dereference.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-27842?
CVE-2020-27842 is a medium-severity vulnerability in Debian Debian Linux, published on 5 Jan 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability.
Weakness: CWE-125
Which versions are affected by CVE-2020-27842?
It affects 11 products.
Products include Debian Debian Linux, Fedoraproject Extra Packages for Enterprise Linux, Fedoraproject Fedora, Oracle Outside in Technology, Redhat Codeready Linux Builder, Redhat Codeready Linux Builder for Ibm Z Systems and 5 more.
How do I fix CVE-2020-27842?
Upgrade to a fixed version.
Is CVE-2020-27842 being exploited?
There is no known exploitation of CVE-2020-27842 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-44106, DEBIAN-CVE-2020-27842, GHSA-f46j-qjjj-q5vh, JLSEC-2026-539, OESA-2022-1486, UBUNTU-CVE-2020-27842.