A heap-buffer overwrites error was discovered in lib/openjp2/mqc.c in OpenJPEG 2.3.1. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
Created mingw-openjpeg2 tracking bugs for this issue: Affects: fedora-all [bug 1902001] Created openjpeg2 tracking bugs for this issue: Affects: epel-all [bug 1901999] Affects: fedora-all [bug 1902000]
Acknowledgments: Name: zodf0055980 (SQLab NCTU Taiwan)
External References: https://github.com/uclouvain/openjpeg/issues/1283
Upstream patches: https://github.com/uclouvain/openjpeg/commit/15cf3d95814dc931ca0ecb132f81cb152e051bae https://github.com/uclouvain/openjpeg/commit/eaa098b59b346cb88e4d10d505061f669d7134fc
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-27814
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4251 https://access.redhat.com/errata/RHSA-2021:4251