An openjpeg2 security update has been released for Debian GNU/Linux 8 Extended LTS to address multiple vulnerabilities.

ELA-596-1 openjpeg2 security update

Package openjpeg2
Version 2.1.0-2+deb8u13
Related CVEs CVE-2020-27842 CVE-2020-27843 CVE-2021-29338

Multiple vulnerabilities have been discovered in openjpeg2, the open-source JPEG 2000 codec.

CVE-2020-27842

Null pointer dereference through specially crafted input. The highest impact
of this flaw is to application availability.

CVE-2020-27843

The flaw allows an attacker to provide specially crafted input to the
conversion or encoding functionality, causing an out-of-bounds read. The
highest threat from this vulnerability is system availability.

CVE-2021-29338

Integer overflow allows remote attackers to crash the application, causing a
denial of service. This occurs when the attacker uses the command line
option "-ImgDir" on a directory that contains 1048576 files.
For Debian 8 jessie, these problems have been fixed in version 2.1.0-2+deb8u13.

We recommend that you upgrade your openjpeg2 packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

  ELA-596-1 openjpeg2 security update