Oracle Georaster vulnerabilities

2 CVEs affecting Oracle Georaster, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-6851, published 2020-01-13.

More from Oracle.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-6851, published 2020-01-13. High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days. OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.
• CVE-2018-6616, published 2018-02-04. Medium severity, CVSS 5.5. EPSS: 1.7% chance of exploitation in the next 30 days. In OpenJPEG 2.3.0, there is excessive iteration in the opj_t1_encode_cblks function of openjp2/t1.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted bmp…