Heap-based buffer overflow in OpenJPEG - CVE-2016-9573

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU14216

Heap-based buffer overflow in OpenJPEG - CVE-2016-9573

Published: August 7, 2018


Vulnerability identifier: #VU14216
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-9573
CWE-ID: CWE-122
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive information or cause the service to crash.

The vulnerability exists in the j2k_to_image component due to due to a heap-based buffer overflow when the j2k_to_image tool handles red, green, blue, and alpha (RGBA) channel dimensions. A remote attacker can execute an application that submits malicious input, trigger out-of-bounds read and gain access to potentially sensitive information or cause the service to crash.


Affected software

OpenJPEG
SUSE Package Hub for SUSE Linux Enterprise
SUSE Linux
Slackware Linux
Fedora
Opensuse
openjpeg2
mingw-openjpeg2

How to mitigate CVE-2016-9573

Update to version 2.2.0 or later.

OpenJPEG - update to 2.2.0
openjpeg2 - addressed in versions 2.1.2-2.fc23, 2.1.2-2.fc24, 2.1.2-2.fc25, 2.1.2-3.fc23
mingw-openjpeg2 - addressed in versions 2.1.2-2.fc23, 2.1.2-2.fc24, 2.1.2-2.fc25, 2.1.2-3.fc23, 2.1.2-3.fc24, 2.1.2-3.fc25

External References

Related Security Bulletins