Linux · Security advisory · November 9, 2021
ALSA-2021:4251: Security update for 4 packages
ALSA-2021:4251, released November 9, 2021, fixes 14 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
14
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0262
85th percentile
Priority of the 14 CVEs
Patch now 0
Urgent 0
High 14
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| openjpeg2 | almalinux 8 | 2.4.0-4.el8 |
| openjpeg2-devel | almalinux 8 | 2.4.0-4.el8 |
| openjpeg2-devel-docs | almalinux 8 | 2.4.0-4.el8 |
| openjpeg2-tools | almalinux 8 | 2.4.0-4.el8 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2020-15389 | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages ha... | 7.8 | 0.0262 | None reported | |
| High | CVE-2019-12973 | libopenjp2-7: In OpenJPEG 2.3.1, there is excessive iteration in the opj_t1_encode_cblksfunction of openjp2/t1.c | 7.8 | 0.0260 | None reported | |
| High | CVE-2018-20845 | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages ha... | 7.8 | 0.0235 | None reported | |
| High | CVE-2018-20847 | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages ha... | 8.8 | 0.0234 | None reported | |
| High | CVE-2018-5785 | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages ha... | 7.8 | 0.0233 | None reported | |
| High | CVE-2020-27814 | libopenjp2-7: A heap-buffer overflow was found in the way openjpeg2 handled certain PNGformat files | 7.8 | 0.0210 | None reported | |
| High | CVE-2018-5727 | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages ha... | 7.8 | 0.0182 | None reported | |
| High | CVE-2020-27843 | libopenjp2-7: A flaw was found in OpenJPEG in versions prior to 2.4.0 | 7.8 | 0.0177 | None reported | |
| High | CVE-2020-27824 | libopenjp2-7: A flaw was found in OpenJPEG’s encoder in theopj_dwt_calc_explicit_stepsizes() function | 7.8 | 0.0161 | None reported | |
| High | CVE-2021-29338 | openjpeg2: OpenJPEG is an open source library for reading and writing image files in JPEG2000 format. The following packages ha... | 7.8 | 0.0156 | None reported | |
| High | CVE-2021-3575 | libopenjp2-7: A heap-based buffer overflow was found in openjpeg in color.c:379:42 insycc420_to_rgb when decompressing a crafted .j... | 7.8 | 0.0155 | None reported | |
| High | CVE-2020-27842 | libopenjp2-7: There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0 | 7.8 | 0.0152 | None reported | |
| High | CVE-2020-27845 | libopenjp2-7: There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to2.4.0 | 7.8 | 0.0152 | None reported | |
| High | CVE-2020-27823 | libopenjpip-server: A flaw was found in OpenJPEG’s encoder | 7.8 | 0.0111 | None reported |
Showing 1 to 14 of 14
1