Detections
Analytics
Alpine: multiple openjpeg packages: security update to 2.3.1-r5 (deprecated)
high Tenable Cloud Security Plugin ID 400310
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could
use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of
the user running such an application. (CVE-2020-27814)
- A flaw was found in OpenJPEG’s encoder. This flaw allows an attacker to pass specially crafted x,y offset
input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to
confidentiality, integrity, as well as system availability. (CVE-2020-27823)
- A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows
an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest
threat from this vulnerability is to system availability. (CVE-2020-27824)
See Also
https://git.alpinelinux.org/aports/commit/?id=037b1d73bce6991807c89f757ee3e3011984a4a7
https://git.alpinelinux.org/aports/commit/?id=8dd89bde5832f9ce55c549f3d7dfb9ee4f2b5b99
Plugin Details
Severity: High
ID: 400310
Version: Revision 1.22
Type: Local
Published: 8/16/2023
Updated: 1/17/2024
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2020-27823
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 7
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/23/2020
Vulnerability Publication Date: 11/28/2020