CVE-2020-27814: 
NixOS vulnerability analysis and mitigation

A heap-buffer overflow vulnerability was discovered in OpenJPEG2's handling of PNG format files. The vulnerability was identified as CVE-2020-27814, disclosed in late 2020. The flaw affects OpenJPEG versions up to 1.5.1 and from 2.0.0 up to (excluding) 2.4.0. This vulnerability impacts various systems and applications that utilize the OpenJPEG library for image processing (NVD, Debian).

The vulnerability is a heap-buffer overflow located in lib/openjp2/mqc.c. When processing certain PNG format files, the flaw can trigger an out-of-bounds write condition. The vulnerability received a CVSS v3.1 Base Score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue was specifically identified in the opj_mqc_byteout function at line 505 of the source code (GitHub Issue).

The vulnerability could allow an attacker to cause an application crash (denial of service) or, in some cases, execute arbitrary code with the permissions of the user running the application. The high CVSS score reflects the potential for significant impact on system confidentiality, integrity, and availability (NVD).

The vulnerability requires user interaction to exploit, as it involves processing a specially crafted PNG file. While the attack complexity is low, the attack vector is local, meaning the attacker needs local access to the system or must convince a user to process a malicious file (NVD, GitHub Issue).

The vulnerability was fixed in OpenJPEG version 2.4.0. Users and administrators are advised to upgrade to this version or later. Multiple Linux distributions have also released security updates to address this vulnerability, including Debian (versions 2.3.0-2+deb10u2 for buster) and Gentoo (Debian Advisory, Gentoo Advisory).