CVE-2020-15389

jp2/opj_decompress.c in OpenJPEG through 2.3.1 has a use-after-free that can be triggered if there is a mix of valid and invalid files in a directory operated on by the decompressor. Triggering a double-free may also be possible. This is related to calling opj_image_destroy twice.

• CWE-416

• https://github.com/uclouvain/openjpeg/issues/1261Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00008.htmlMailing List, Third Party Advisory
• https://pastebin.com/4sDKQ7U8Third Party Advisory
• https://security.gentoo.org/glsa/202101-29Third Party Advisory
• https://www.debian.org/security/2021/dsa-4882Third Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
• https://github.com/uclouvain/openjpeg/issues/1261Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00008.htmlMailing List, Third Party Advisory
• https://pastebin.com/4sDKQ7U8Third Party Advisory
• https://security.gentoo.org/glsa/202101-29Third Party Advisory
• https://www.debian.org/security/2021/dsa-4882Third Party Advisory
• https://www.oracle.com//security-alerts/cpujul2021.htmlThird Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory

Published

Jun 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15383Running security scans against the SAN switch can cause conf…7.5
• CVE-2020-15384Brocade SANNav before version 2.1.1 contains an information …5.3
• CVE-2020-15385Brocade SANnav before version 2.1.1 allows an authenticated …5.4
• CVE-2020-15386Brocade Fabric OS prior to v9.0.1a and 8.2.3a and after v9.0…5.3
• CVE-2020-15387The host SSH servers of Brocade Fabric OS before Brocade Fab…7.4
• CVE-2020-15388A vulnerability in the Brocade Fabric OS before Brocade Fabr…6.5
• CVE-2020-1539An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15390pyActivity in Pega Platform 8.4.0.237 has a security misconf…9.8
• CVE-2020-15391The UI in DevSpace 4.13.0 allows web sites to execute action…9.8
• CVE-2020-15392A user enumeration vulnerability flaw was found in Venki Sup…5.3
• CVE-2020-15393In the Linux kernel 4.4 through 5.7.6, usbtest_disconnect in…5.5
• CVE-2020-15394The REST API in Zoho ManageEngine Applications Manager befor…9.8