# ALSA-2021:4251: Security update for 4 packages

ALSA-2021:4251, released November 9, 2021, fixes 14 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/alsa-2021-4251
- Platform: Linux
- Released: Nov 9, 2021
- Priority: High (Closes CVE-2020-15389, high severity)
- CVEs: 14, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/ALSA-2021:4251

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [openjpeg2](https://patchblox.com/security/data/product/linux/openjpeg2.md) | almalinux 8 | 2.4.0-4.el8 |
| [openjpeg2-devel](https://patchblox.com/security/data/product/linux/openjpeg2-devel.md) | almalinux 8 | 2.4.0-4.el8 |
| [openjpeg2-devel-docs](https://patchblox.com/security/data/product/linux/openjpeg2-devel-docs.md) | almalinux 8 | 2.4.0-4.el8 |
| [openjpeg2-tools](https://patchblox.com/security/data/product/linux/openjpeg2-tools.md) | almalinux 8 | 2.4.0-4.el8 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2020-15389](https://patchblox.com/security/data/cve/CVE-2020-15389.md) | High | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.  The following packages ha... | 7.8 | 0.0262 |  |
| [CVE-2019-12973](https://patchblox.com/security/data/cve/CVE-2019-12973.md) | High | libopenjp2-7: In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblksfunction of openjp2/t1.c | 7.8 | 0.0260 |  |
| [CVE-2018-20845](https://patchblox.com/security/data/cve/CVE-2018-20845.md) | High | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.  The following packages ha... | 7.8 | 0.0235 |  |
| [CVE-2018-20847](https://patchblox.com/security/data/cve/CVE-2018-20847.md) | High | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.  The following packages ha... | 8.8 | 0.0234 |  |
| [CVE-2018-5785](https://patchblox.com/security/data/cve/CVE-2018-5785.md) | High | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.  The following packages ha... | 7.8 | 0.0233 |  |
| [CVE-2020-27814](https://patchblox.com/security/data/cve/CVE-2020-27814.md) | High | libopenjp2-7: A heap-buffer overflow was found in the way openjpeg2 handled certain PNGformat files | 7.8 | 0.0210 |  |
| [CVE-2018-5727](https://patchblox.com/security/data/cve/CVE-2018-5727.md) | High | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.  The following packages ha... | 7.8 | 0.0182 |  |
| [CVE-2020-27843](https://patchblox.com/security/data/cve/CVE-2020-27843.md) | High | libopenjp2-7: A flaw was found in OpenJPEG in versions prior to 2.4.0 | 7.8 | 0.0177 |  |
| [CVE-2020-27824](https://patchblox.com/security/data/cve/CVE-2020-27824.md) | High | libopenjp2-7: A flaw was found in OpenJPEG’s encoder in theopj_dwt_calc_explicit_stepsizes() function | 7.8 | 0.0161 |  |
| [CVE-2021-29338](https://patchblox.com/security/data/cve/CVE-2021-29338.md) | High | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.  The following packages ha... | 7.8 | 0.0156 |  |
| [CVE-2021-3575](https://patchblox.com/security/data/cve/CVE-2021-3575.md) | High | libopenjp2-7: A heap-based buffer overflow was found in openjpeg in color.c:379:42 insycc420_to_rgb when decompressing a crafted .j... | 7.8 | 0.0155 |  |
| [CVE-2020-27842](https://patchblox.com/security/data/cve/CVE-2020-27842.md) | High | libopenjp2-7: There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0 | 7.8 | 0.0152 |  |
| [CVE-2020-27845](https://patchblox.com/security/data/cve/CVE-2020-27845.md) | High | libopenjp2-7: There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to2.4.0 | 7.8 | 0.0152 |  |
| [CVE-2020-27823](https://patchblox.com/security/data/cve/CVE-2020-27823.md) | High | libopenjpip-server: A flaw was found in OpenJPEG’s encoder | 7.8 | 0.0111 |  |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo