An openjpeg2 security update has been released for Debian GNU/Linux 8 Extended LTS to address several issues.
ELA-373-1 openjpeg2 security update
Package openjpeg2
ELA-373-1 openjpeg2 security update
Version 2.1.0-2+deb8u12
Related CVEs CVE-2020-27824 CVE-2020-27841 CVE-2020-27845
Several issues were identified in openjpeg2.
CVE-2020-27824: Global buffer overflow on irreversible conversion when too many decomposition levels are specified.
CVE-2020-27841: Crafted input to be processed by the openjpeg encoder could cause an out-of-bounds read.
CVE-2020-27845: Crafted input can cause out-of-bounds-read.
For Debian 8 jessie, these problems have been fixed in version 2.1.0-2+deb8u12.
We recommend that you upgrade your openjpeg2 packages.
Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/
