An openjpeg2 security update has been released for Debian GNU/Linux 8 LTS to address a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor.
ELA-241-1 openjpeg2 security update
Package openjpeg2
ELA-241-1 openjpeg2 security update
Version 2.1.0-2+deb8u11
Related CVE CVE-2020-15389
jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor.
Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.
For Debian 8 jessie, these problems have been fixed in version 2.1.0-2+deb8u11.
We recommend that you upgrade your openjpeg2 packages.
Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/
