Every CVE Search/ Get API key

CVE-2020-27844

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows...

7.8 HighFix available

CVE-2020-27844 is a high vulnerability (CVSS 7.8) in Uclouvain Openjpeg, published January 5, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in chromium 89.0.4389.72-r0.

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.39%Up 0.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Record
CVE-2020-27844
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
8.3 HighAV:N/AC:M/Au:N/C:P/I:P/A:C
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Record
CVE-2020-27844
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2020-20342 No score

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Record
EUVD-2020-20342
Updated
2026-11-03
GitHub AdvisoriesGHSA-p652-vj2w-8mcw 7.8

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows...

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Record
GHSA-p652-vj2w-8mcw
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-20, CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2020-27844 7.8

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Record
ALPINE-CVE-2020-27844
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVAZL-44178 7.8

CVE-2020-27844 affecting package openjpeg2 2.3.1-12

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Record
AZL-44178
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVBELL-CVE-2020-27844 7.8

CVE-2020-27844 does not affect BellSoft software

Record
BELL-CVE-2020-27844
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Record
CVE-2020-27844
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVJLSEC-2026-541 7.8

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Record
JLSEC-2026-541
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
8.3 HighAV:N/AC:M/Au:N/C:P/I:P/A:C
Updated
2026-11-02
OSVUBUNTU-CVE-2020-27844 7.8

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Record
UBUNTU-CVE-2020-27844
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2021-0093 No score

Updated openjpeg2 packages fix security vulnerability

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-27844).

Record
MGASA-2021-0093
Updated
2026-11-02
OSVMGASA-2021-0142 No score

Updated chromium-browser-stable packages fix security vulnerability

The updated packages fix security vulnerabilities. At least one of them is known to be actively exploited.

Record
MGASA-2021-0142
Updated
2026-11-02
OSVopenSUSE-SU-2021:0392-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Update to 89.0.4389.72 (boo#1182358, boo#1182960):

  • CVE-2021-21159: Heap buffer overflow in TabStrip.
  • CVE-2021-21160: Heap buffer overflow in WebAudio.
  • CVE-2021-21161: Heap buffer overflow in TabStrip.
  • CVE-2021-21162: Use after free in WebRTC.
  • CVE-2021-21163: Insufficient data validation in Reader Mode.
  • CVE-2021-21164: Insufficient data validation in Chrome for iOS.
  • CVE-2021-21165: Object lifecycle issue in audio.
  • CVE-2021-21166: Object lifecycle issue in audio.
  • CVE-2021-21167: Use after free in bookmarks.
  • CVE-2021-21168: Insufficient policy enforcement in appcache.
  • CVE-2021-21169: Out of bounds memory access in V8.
  • CVE-2021-21170: Incorrect security UI in Loader.
  • CVE-2021-21171: Incorrect security UI in TabStrip and Navigation.
  • CVE-2021-21172: Insufficient policy enforcement in File System API.
  • CVE-2021-21173: Side-channel information leakage in Network Internals.
  • CVE-2021-21174: Inappropriate implementation in Referrer.
  • CVE-2021-21175: Inappropriate implementation in Site isolation.
  • CVE-2021-21176: Inappropriate implementation in full screen mode.
  • CVE-2021-21177: Insufficient policy enforcement in Autofill.
  • CVE-2021-21178: Inappropriate implementation in Compositing.
  • CVE-2021-21179: Use after free in Network Internals.
  • CVE-2021-21180: Use after free in tab search.
  • CVE-2020-27844: Heap buffer overflow in OpenJPEG.
  • CVE-2021-21181: Side-channel information leakage in autofill.
  • CVE-2021-21182: Insufficient policy enforcement in navigations.
  • CVE-2021-21183: Inappropriate implementation in performance APIs.
  • CVE-2021-21184: Inappropriate implementation in performance APIs.
  • CVE-2021-21185: Insufficient policy enforcement in extensions.
  • CVE-2021-21186: Insufficient policy enforcement in QR scanning.
  • CVE-2021-21187: Insufficient data validation in URL formatting.
  • CVE-2021-21188: Use after free in Blink.
  • CVE-2021-21189: Insufficient policy enforcement in payments.
  • CVE-2021-21190: Uninitialized Use in PDFium.
  • CVE-2021-21149: Stack overflow in Data Transfer.
  • CVE-2021-21150: Use after free in Downloads.
  • CVE-2021-21151: Use after free in Payments.
  • CVE-2021-21152: Heap buffer overflow in Media.
  • CVE-2021-21153: Stack overflow in GPU Process.
  • CVE-2021-21154: Heap buffer overflow in Tab Strip.
  • CVE-2021-21155: Heap buffer overflow in Tab Strip.
  • CVE-2021-21156: Heap buffer overflow in V8.
  • CVE-2021-21157: Use after free in Web Sockets.
  • Fixed Sandbox with glibc 2.33 (boo#1182233)
  • Fixed an issue where chromium hangs on opening (boo#1182775).
Record
openSUSE-SU-2021:0392-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:0401-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Update to 89.0.4389.72 (boo#1182358, boo#1182960):

  • CVE-2021-21159: Heap buffer overflow in TabStrip.
  • CVE-2021-21160: Heap buffer overflow in WebAudio.
  • CVE-2021-21161: Heap buffer overflow in TabStrip.
  • CVE-2021-21162: Use after free in WebRTC.
  • CVE-2021-21163: Insufficient data validation in Reader Mode.
  • CVE-2021-21164: Insufficient data validation in Chrome for iOS.
  • CVE-2021-21165: Object lifecycle issue in audio.
  • CVE-2021-21166: Object lifecycle issue in audio.
  • CVE-2021-21167: Use after free in bookmarks.
  • CVE-2021-21168: Insufficient policy enforcement in appcache.
  • CVE-2021-21169: Out of bounds memory access in V8.
  • CVE-2021-21170: Incorrect security UI in Loader.
  • CVE-2021-21171: Incorrect security UI in TabStrip and Navigation.
  • CVE-2021-21172: Insufficient policy enforcement in File System API.
  • CVE-2021-21173: Side-channel information leakage in Network Internals.
  • CVE-2021-21174: Inappropriate implementation in Referrer.
  • CVE-2021-21175: Inappropriate implementation in Site isolation.
  • CVE-2021-21176: Inappropriate implementation in full screen mode.
  • CVE-2021-21177: Insufficient policy enforcement in Autofill.
  • CVE-2021-21178: Inappropriate implementation in Compositing.
  • CVE-2021-21179: Use after free in Network Internals.
  • CVE-2021-21180: Use after free in tab search.
  • CVE-2020-27844: Heap buffer overflow in OpenJPEG.
  • CVE-2021-21181: Side-channel information leakage in autofill.
  • CVE-2021-21182: Insufficient policy enforcement in navigations.
  • CVE-2021-21183: Inappropriate implementation in performance APIs.
  • CVE-2021-21184: Inappropriate implementation in performance APIs.
  • CVE-2021-21185: Insufficient policy enforcement in extensions.
  • CVE-2021-21186: Insufficient policy enforcement in QR scanning.
  • CVE-2021-21187: Insufficient data validation in URL formatting.
  • CVE-2021-21188: Use after free in Blink.
  • CVE-2021-21189: Insufficient policy enforcement in payments.
  • CVE-2021-21190: Uninitialized Use in PDFium.
  • CVE-2021-21149: Stack overflow in Data Transfer.
  • CVE-2021-21150: Use after free in Downloads.
  • CVE-2021-21151: Use after free in Payments.
  • CVE-2021-21152: Heap buffer overflow in Media.
  • CVE-2021-21153: Stack overflow in GPU Process.
  • CVE-2021-21154: Heap buffer overflow in Tab Strip.
  • CVE-2021-21155: Heap buffer overflow in Tab Strip.
  • CVE-2021-21156: Heap buffer overflow in V8.
  • CVE-2021-21157: Use after free in Web Sockets.
  • Fixed Sandbox with glibc 2.33 (boo#1182233)
  • Fixed an issue where chromium hangs on opening (boo#1182775).

This update was imported from the openSUSE:Leap:15.2:Update update project.

Record
openSUSE-SU-2021:0401-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score

chromedriver-93.0.4577.82-1.1 on GA media

These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10681-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score

ungoogled-chromium-113.0.5672.92-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12948-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium
Alpine:v3.14
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.15
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.16
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.17
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.18
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.19
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.20
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.21
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.22
 before 89.0.4389.72-r0
89.0.4389.72-r0
chromium
Alpine:v3.23
 before 89.0.4389.72-r0
89.0.4389.72-r0
Show 39 moreShow less
Affected packages
PackageAffectedFixed
chromium
Alpine:v3.24
 before 89.0.4389.72-r0
89.0.4389.72-r0
openjpeg
Alpine:v3.10
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.11
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.12
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.13
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.14
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.15
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.16
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.17
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.18
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.19
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.20
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.21
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.22
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.23
 before 2.4.0-r0
2.4.0-r0
openjpeg
Alpine:v3.24
 before 2.4.0-r0
2.4.0-r0
qt5-qtwebengine
Alpine:v3.14
 before 5.15.3_git20200401-r0
5.15.3_git20200401-r0
qt5-qtwebengine
Alpine:v3.15
 before 5.15.3_git20200401-r0
5.15.3_git20200401-r0
qt5-qtwebengine
Alpine:v3.16
 before 5.15.3_git20200401-r0
5.15.3_git20200401-r0
qt5-qtwebengine
Alpine:v3.17
 before 5.15.3_git20200401-r0
5.15.3_git20200401-r0
qt5-qtwebengine
Alpine:v3.18
 before 5.15.3_git20200401-r0
5.15.3_git20200401-r0
qt5-qtwebengine
Alpine:v3.19
 before 5.15.3_git20200401-r0
5.15.3_git20200401-r0
qt5-qtwebengine
Alpine:v3.20
 before 5.15.3_git20200401-r0
5.15.3_git20200401-r0
qt5-qtwebengine
Alpine:v3.21
 before 5.15.3_git20200401-r0
5.15.3_git20200401-r0
qt5-qtwebengine
Alpine:v3.22
 before 5.15.3_git20200401-r0
5.15.3_git20200401-r0
qt5-qtwebengine
Alpine:v3.23
 before 5.15.3_git20200401-r0
5.15.3_git20200401-r0
openjpeg2
Azure Linux:3
 through 2.3.1-12 None known
OpenJpeg_jll
Julia
 before 2.4.0+0
2.4.0+0
openjpeg2
Mageia:7
 before 2.4.0-1.mga7
2.4.0-1.mga7
chromium-browser-stable
Mageia:7
 before 89.0.4389.90-1.mga7
89.0.4389.90-1.mga7
chromium-browser-stable
Mageia:8
 before 89.0.4389.90-1.mga8
89.0.4389.90-1.mga8
insighttoolkit4
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.8.1-1ubuntu34.8.1-1ubuntu44.8.2-3.1ubuntu14.9.0-3ubuntu24.9.0-4ubuntu14.9.0-4ubuntu1.1
 None known
insighttoolkit4
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.12.2-dfsg1-1ubuntu1
 None known
insighttoolkit4
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.12.2-dfsg1-4.1ubuntu14.13.2-dfsg1-1ubuntu14.13.2-dfsg1-4ubuntu14.13.2-dfsg1-64.13.2-dfsg1-6ubuntu14.13.2-dfsg1-8
 None known
insighttoolkit4
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.13.3withdata-dfsg1-4.14.13.3withdata-dfsg2-1ubuntu1
 None known
chromium
openSUSE:Leap 15.2
 before 89.0.4389.72-lp152.2.77.1
89.0.4389.72-lp152.2.77.1
chromium
SUSE:Package Hub 15 SP2
 before 89.0.4389.72-bp152.2.62.1
89.0.4389.72-bp152.2.62.1
chromium
openSUSE:Tumbleweed
 before 93.0.4577.82-1.1
93.0.4577.82-1.1
chromium
openSUSE:Tumbleweed
 before 113.0.5672.92-1.1
113.0.5672.92-1.1

History

History
WhenChangedSources
2026-11-03affectedOSV
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 2,136 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open