TI-2020-05557 Aliases CVE-2020-6851 GHSA-6gvh-974v-q8vj

OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor…

MEDIUM 41CWE-787Published 2020-01-13 · Updated 2026-09-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.

Why it matters now

EPSS 0.05285 92nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPE	Versions	Role	Vendor
cpe:2.3:a:uclouvain:openjpeg::::::::	up to 2.3.1	Vulnerable	The OpenJPEG Project
cpe:2.3:o:fedoraproject:fedora:30:::::::*	30	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:31:::::::*	31	Vulnerable	Fedoraproject
cpe:2.3:o:debian:debian_linux:8.0:::::::*	8.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:9.0:::::::*	9.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*	8.0	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*	7.0	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:::::::*	7.7	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:::::::*	8.1	Vulnerable	Red Hat

cpe:2.3:a:uclouvain:openjpeg:*:*:*:*:*:*:*:* Versions up to 2.3.1 Vulnerable ·The OpenJPEG Project
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·Red Hat

Show 13 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:::::::*	8.2	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:::::::*	8.4	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*	7.0	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:::::::*	7.7	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:::::::*	8.2	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:::::::*	8.4	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:::::::*	7.7	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:::::::*	8.2	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:::::::*	8.4	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*	7.0	Vulnerable	Red Hat
cpe:2.3:a:oracle:georaster:18c:::::::*	18c	Vulnerable	Oracle
cpe:2.3:a:oracle:outside_in_technology:8.5.4:::::::*	8.5.4	Vulnerable	Oracle
cpe:2.3:a:oracle:outside_in_technology:8.5.5:::::::*	8.5.5	Vulnerable	Oracle

cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* Versions 8.2 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
cpe:2.3:a:oracle:georaster:18c:*:*:*:*:*:*:* Versions 18c Vulnerable ·Oracle
cpe:2.3:a:oracle:outside_in_technology:8.5.4:*:*:*:*:*:*:* Versions 8.5.4 Vulnerable ·Oracle
cpe:2.3:a:oracle:outside_in_technology:8.5.5:*:*:*:*:*:*:* Versions 8.5.5 Vulnerable ·Oracle

Remediation

Red Hat 3 advisories

RHSA-2020:0296 Released 2020-01-30 · Red Hat rating Important
openjpeg2 security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.0) openjpeg2-2.3.0-9.el8_0, openjpeg2-devel-docs-2.3.0-9.el8_0, openjpeg2-tools-2.3.0-9.el8_0
RHSA-2020:0274 Released 2020-01-29 · Red Hat rating Important
openjpeg2 security update
- Red Hat CodeReady Linux Builder (v. 8) openjpeg2-devel-2.3.1-2.el8_1, openjpeg2-tools-2.3.1-2.el8_1
- Red Hat Enterprise Linux AppStream (v. 8) openjpeg2-2.3.1-2.el8_1, openjpeg2-devel-docs-2.3.1-2.el8_1, openjpeg2-tools-2.3.1-2.el8_1
RHSA-2020:0262 Released 2020-01-28 · Red Hat rating Important
openjpeg2 security update
- Red Hat Enterprise Linux Client (v. 7) openjpeg2-2.3.1-2.el7_7
- Red Hat Enterprise Linux Client Optional (v. 7) openjpeg2-devel-2.3.1-2.el7_7, openjpeg2-devel-docs-2.3.1-2.el7_7, openjpeg2-tools-2.3.1-2.el7_7
- Red Hat Enterprise Linux ComputeNode (v. 7) openjpeg2-2.3.1-2.el7_7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openjpeg2-devel-2.3.1-2.el7_7, openjpeg2-devel-docs-2.3.1-2.el7_7, openjpeg2-tools-2.3.1-2.el7_7
- Red Hat Enterprise Linux Server (v. 7) openjpeg2-2.3.1-2.el7_7, openjpeg2-2.3.1-2.el7_7.ppc
- Red Hat Enterprise Linux Server Optional (v. 7) openjpeg2-devel-2.3.1-2.el7_7, openjpeg2-devel-2.3.1-2.el7_7.ppc, openjpeg2-devel-docs-2.3.1-2.el7_7 +2
- Red Hat Enterprise Linux Workstation (v. 7) openjpeg2-2.3.1-2.el7_7
- Red Hat Enterprise Linux Workstation Optional (v. 7) openjpeg2-devel-2.3.1-2.el7_7, openjpeg2-devel-docs-2.3.1-2.el7_7, openjpeg2-tools-2.3.1-2.el7_7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat CodeReady Linux Builder (v. 8)	Fixed	RHSA-2020:0274
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2020:0274
Red Hat Enterprise Linux AppStream E4S (v. 8.0)	Fixed	RHSA-2020:0296
Red Hat Enterprise Linux Client (v. 7)	Fixed	RHSA-2020:0262
Red Hat Enterprise Linux Client Optional (v. 7)	Fixed	RHSA-2020:0262
Red Hat Enterprise Linux ComputeNode (v. 7)	Fixed	RHSA-2020:0262
Red Hat Enterprise Linux ComputeNode Optional (v. 7)	Fixed	RHSA-2020:0262
Red Hat Enterprise Linux Server (v. 7)	Fixed	RHSA-2020:0262
Red Hat Enterprise Linux Server Optional (v. 7)	Fixed	RHSA-2020:0262
Red Hat Enterprise Linux Workstation (v. 7)	Fixed	RHSA-2020:0262
Red Hat Enterprise Linux Workstation Optional (v. 7)	Fixed	RHSA-2020:0262

Not affected: 2 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7

Timeline

2026-10-02 Threatist record created from CVE-2020-6851
2026-10-03 Alias added: GHSA-6gvh-974v-q8vj

References

Exploit 1

https://github.com/uclouvain/openjpeg/issues/1228

Patch 1

https://www.oracle.com/security-alerts/cpujul2020.html

Advisory 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences