openjpeg: heap-based buffer overflow in opj_t2_encode_packet function in openjp2/t2.c (CVE-2020-27844)

A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

References:

• https://nvd.nist.gov/vuln/detail/CVE-2020-27844
• https://github.com/uclouvain/openjpeg/issues/1299

Patch:

https://github.com/uclouvain/openjpeg/commit/73fdf28342e4594019af26eb6a347a34eceb6296

Affected branches:

• master (de75decf)
• 3.13-stable (de75decf)
• 3.12-stable
• 3.11-stable
• 3.10-stable