| Package | openjpeg2 |
|---|---|
| Version | 2.1.0-2+deb8u11 |
| Related CVEs | CVE-2020-15389 |
jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can
be triggered if there is a mix of valid and invalid files in a directory
operated on by the decompressor.
Triggering a double-free may also be possible. This is related to calling
opj_image_destroy twice.
For Debian 8 jessie, these problems have been fixed in version 2.1.0-2+deb8u11.
We recommend that you upgrade your openjpeg2 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.