CVE-2020-15389

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated…

published June 29, 2020

CVSS
—
EPSS
3%
Percentile
85.2
In the wild
Unconfirmed
What it is

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02595 · 85.2th percentile
Published
2020-06-29T20:30Z
EPSS history
Timeline
  • 29 JUN 20:30Z
    jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated…
    cvelistv5