Test ID:	1.3.6.1.4.1.25623.1.1.10.2020.0464
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2020-0464)
Summary:	The remote host is missing an update for the 'openjpeg2' package(s) announced via the MGASA-2020-0464 advisory.
Description:	Summary: The remote host is missing an update for the 'openjpeg2' package(s) announced via the MGASA-2020-0464 advisory. Vulnerability Insight: A heap-buffer overwrites error was discovered in lib/openjp2/mqc.c in OpenJPEG 2.3.1. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution (CVE-2020-27814). A flaw was found in OpenJPEG's encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability (CVE-2020-27823). There is a flaw in openjpeg's encoder in the opj_dwt_calc_explicit_stepsizes() function. An attacker who is able to supply crafted input to decomposition levels could cause a buffer overflow, potentially causing an impact to application availability (CVE-2020-27824). Affected Software/OS: 'openjpeg2' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-27814 Debian Security Information: DSA-4882 (Google Search) https://www.debian.org/security/2021/dsa-4882 https://security.gentoo.org/glsa/202101-29 https://bugzilla.redhat.com/show_bug.cgi?id=1901998 https://github.com/uclouvain/openjpeg/issues/1283 https://www.oracle.com//security-alerts/cpujul2021.html https://lists.debian.org/debian-lts-announce/2021/02/msg00011.html Common Vulnerability Exposure (CVE) ID: CVE-2020-27823 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQR4EWRFFZQDMFPZKFZ6I3USLMW6TKTP/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WJUPGIZE6A4O52EBOF75MCXJOL6MUCRV/ https://bugzilla.redhat.com/show_bug.cgi?id=1905762 Common Vulnerability Exposure (CVE) ID: CVE-2020-27824 https://bugzilla.redhat.com/show_bug.cgi?id=1905723 https://www.oracle.com/security-alerts/cpuoct2021.html
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.