A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an     attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds     write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-27844)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an
    attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds
    write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system
    availability. (CVE-2020-27844)

  - Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21159, CVE-2021-21161)

  - Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21160)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an
    attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds
    write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system
    availability. (CVE-2020-27844)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an
    attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds
    write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system
    availability. (CVE-2020-27844)

  - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially
    exploit heap corruption via a crafted SCTP packet. (CVE-2020-16044)

  - Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to
    potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21118)

  - Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had
    compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-21119)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2021 CPU advisory.

  - Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions     that are affected are 12.1.0.2 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker     with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require     human interaction from a person other than the attacker and while the vulnerability is in Advanced     Networking Option, attacks may significantly impact additional products. Successful attacks of this     vulnerability can result in takeover of Advanced Networking Option. (CVE-2021-2351)

  - Vulnerability in the Oracle Text component of Oracle Database Server. Supported versions that are affected     are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Any     Procedure, Alter Any Table privilege with network access via Oracle Net to compromise Oracle Text.
    Successful   attacks of this vulnerability can result in takeover of Oracle Text. (CVE-2021-2328)

  - Vulnerability in the Oracle XML DB component of Oracle Database Server. Supported versions that are     affected   are 12.1.0.2 and 19c. Easily exploitable vulnerability allows high privileged attacker having     Create Any   Procedure, Create Public Synonym privilege with network access via Oracle Net to compromise     Oracle XML DB.   Successful attacks of this vulnerability can result in takeover of Oracle XML DB.
    (CVE-2021-2329)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote host is prior to 89.0.4389.72. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_03_stable-channel-update-for-desktop advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for chromium fixes the following issues :

Update to 89.0.4389.72 (boo#1182358, boo#1182960) :

  - CVE-2021-21159: Heap buffer overflow in TabStrip.

  - CVE-2021-21160: Heap buffer overflow in WebAudio.

  - CVE-2021-21161: Heap buffer overflow in TabStrip.

  - CVE-2021-21162: Use after free in WebRTC.

  - CVE-2021-21163: Insufficient data validation in Reader     Mode.

  - CVE-2021-21164: Insufficient data validation in Chrome     for iOS.

  - CVE-2021-21165: Object lifecycle issue in audio.

  - CVE-2021-21166: Object lifecycle issue in audio.

  - CVE-2021-21167: Use after free in bookmarks.

  - CVE-2021-21168: Insufficient policy enforcement in     appcache.

  - CVE-2021-21169: Out of bounds memory access in V8.

  - CVE-2021-21170: Incorrect security UI in Loader.

  - CVE-2021-21171: Incorrect security UI in TabStrip and     Navigation.

  - CVE-2021-21172: Insufficient policy enforcement in File     System API.

  - CVE-2021-21173: Side-channel information leakage in     Network Internals.

  - CVE-2021-21174: Inappropriate implementation in     Referrer.

  - CVE-2021-21175: Inappropriate implementation in Site     isolation.

  - CVE-2021-21176: Inappropriate implementation in full     screen mode.

  - CVE-2021-21177: Insufficient policy enforcement in     Autofill.

  - CVE-2021-21178: Inappropriate implementation in     Compositing.

  - CVE-2021-21179: Use after free in Network Internals.

  - CVE-2021-21180: Use after free in tab search.

  - CVE-2020-27844: Heap buffer overflow in OpenJPEG.

  - CVE-2021-21181: Side-channel information leakage in     autofill.

  - CVE-2021-21182: Insufficient policy enforcement in     navigations.

  - CVE-2021-21183: Inappropriate implementation in     performance APIs.

  - CVE-2021-21184: Inappropriate implementation in     performance APIs.

  - CVE-2021-21185: Insufficient policy enforcement in     extensions.

  - CVE-2021-21186: Insufficient policy enforcement in QR     scanning.

  - CVE-2021-21187: Insufficient data validation in URL     formatting.

  - CVE-2021-21188: Use after free in Blink.

  - CVE-2021-21189: Insufficient policy enforcement in     payments.

  - CVE-2021-21190: Uninitialized Use in PDFium.

  - CVE-2021-21149: Stack overflow in Data Transfer.

  - CVE-2021-21150: Use after free in Downloads.

  - CVE-2021-21151: Use after free in Payments.

  - CVE-2021-21152: Heap buffer overflow in Media.

  - CVE-2021-21153: Stack overflow in GPU Process. 

  - CVE-2021-21154: Heap buffer overflow in Tab Strip.

  - CVE-2021-21155: Heap buffer overflow in Tab Strip.

  - CVE-2021-21156: Heap buffer overflow in V8.

  - CVE-2021-21157: Use after free in Web Sockets. 

  - Fixed Sandbox with glibc 2.33 (boo#1182233)

  - Fixed an issue where chromium hangs on opening     (boo#1182775).

The version of Microsoft Edge installed on the remote Windows host is prior to 89.0.774.45. It is, therefore, affected by multiple vulnerabilities as referenced in the March 4, 2021 advisory.

  - A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an     attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds     write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-27844)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chrome Releases reports :

This release includes 47 security fixes, including the below. Google is aware of reports that an exploit for CVE-2021-21166 exists in the wild. Please see URL for details.

The version of Google Chrome installed on the remote macOS host is prior to 89.0.4389.72. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_03_stable-channel-update-for-desktop advisory.

  - Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted PDF file. (CVE-2021-21190)

  - A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an     attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds     write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-27844)

  - Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21159, CVE-2021-21161)

  - Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21160)

  - Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 89.0.4389.72. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_03_stable-channel-update-for-desktop advisory.

  - Uninitialized data in PDFium in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to obtain     potentially sensitive information from process memory via a crafted PDF file. (CVE-2021-21190)

  - A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an     attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds     write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system     availability. (CVE-2020-27844)

  - Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21159, CVE-2021-21161)

  - Heap buffer overflow in WebAudio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21160)

  - Use after free in WebRTC in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Various overflow errors were identified and fixed.

CVE-2020-27814

A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files.

CVE-2020-27823

Wrong computation of x1,y1 if -d option is used, resulting in heap buffer overflow.

CVE-2020-27824

Global buffer overflow on irreversible conversion when too many decomposition levels are specified.

CVE-2020-27841

Crafted input to be processed by the openjpeg encoder could cause an out-of-bounds read.

CVE-2020-27844

Crafted input to be processed by the openjpeg encoder could cause an out-of-bounds write.

CVE-2020-27845

Crafted input can cause out-of-bounds-read.

For Debian 9 stretch, these problems have been fixed in version 2.1.2-1.1+deb9u6.

We recommend that you upgrade your openjpeg2 packages.

For the detailed security status of openjpeg2 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/openjpeg2

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202101-29 (OpenJPEG: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenJPEG. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
255418	Linux Distros Unpatched Vulnerability : CVE-2020-27844	Nessus	Misc.	high
426930	Alpine: multiple chromium packages: security update to 89.0.4389.72-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
426930	Alpine: multiple chromium packages: security update to 89.0.4389.72-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
424284	Alpine: multiple openjpeg packages: security update to 2.4.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424284	Alpine: multiple openjpeg packages: security update to 2.4.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
406832	Alpine: qt5-qtwebengine: security update to 5.15.3_git20200401-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
406832	Alpine: qt5-qtwebengine: security update to 5.15.3_git20200401-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
405999	Alpine: openjpeg: security update to 2.4.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405999	Alpine: openjpeg: security update to 2.4.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
403818	Alpine: multiple chromium packages: security update to 89.0.4389.72-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403818	Alpine: multiple chromium packages: security update to 89.0.4389.72-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
152026	Oracle Database Server Multiple Vulnerabilities (Jul 2021 CPU)	Nessus	Databases	critical
701324	Google Chrome < 89.0.4389.72 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
147606	openSUSE Security Update : chromium (openSUSE-2021-392)	Nessus	SuSE Local Security Checks	critical
147192	Microsoft Edge (Chromium) < 89.0.774.45 Multiple Vulnerabilities	Nessus	Windows	high
147152	FreeBSD : chromium -- multiple vulnerabilities (f00b65d8-7ccb-11eb-b3be-e09467587c17)	Nessus	FreeBSD Local Security Checks	high
146949	Google Chrome < 89.0.4389.72 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
146948	Google Chrome < 89.0.4389.72 Multiple Vulnerabilities	Nessus	Windows	high
146321	Debian DLA-2550-1 : openjpeg2 security update	Nessus	Debian Local Security Checks	high
145436	GLSA-202101-29 : OpenJPEG: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2020-27844

high

Tenable Plugins

high

high

high

high

high

critical

critical

high

high

high

high

critical

high

critical

high

high

high

high

high

high