Integer overflow in OpenJPEG - CVE-2016-9580

Vulnerability identifier: #VU33222

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-9580

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.

OpenJPEG
SUSE Package Hub for SUSE Linux Enterprise
openjpeg (Alpine package)
openjpeg2
mingw-openjpeg2
SUSE Linux
Slackware Linux
Fedora
Opensuse

Install update from vendor's website.

OpenJPEG - update to 2.2.0
openjpeg (Alpine package) - update to 2.1.2-r1
openjpeg2 - addressed in versions 2.1.2-3.fc23, 2.1.2-3.fc24, 2.1.2-3.fc25
mingw-openjpeg2 - addressed in versions 2.1.2-3.fc23, 2.1.2-3.fc24, 2.1.2-3.fc25

• http://www.securityfocus.com/bid/94822
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9580
• https://github.com/szukw000/openjpeg/commit/cadff5fb6e73398de26a92e96d3d7cac893af255
• https://github.com/uclouvain/openjpeg/issues/871
• https://security.gentoo.org/glsa/201710-26

• Integer overflow in OpenJPEG
• Integer overflow in openjpeg (Alpine package)
• OpenSUSE Linux update for openjpeg2
• OpenSUSE Linux update for openjpeg2
• OpenSUSE Linux update for openjpeg2
• SUSE Linux update for openjpeg2
• Slackware Linux update for openjpeg
• Fedora 25 update for openjpeg2
• Fedora 23 update for openjpeg2
• Fedora 24 update for openjpeg2
• Fedora 23 update for mingw-openjpeg2
• Fedora 25 update for mingw-openjpeg2
• Fedora 24 update for mingw-openjpeg2