Out-of-bounds read in OpenJPEG - CVE-2016-3183

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU63445

Out-of-bounds read in OpenJPEG - CVE-2016-3183

Published: May 19, 2022


Vulnerability identifier: #VU63445
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-3183
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the sycc422_t_rgb() function in common/color.c. A remote attacker can create a specially crafted JPEG 2000 image, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.


Affected software

OpenJPEG
Gentoo Linux
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Fedora
media-libs/openjpeg
libopenjp2-7
libopenjp2-7-debuginfo
openjpeg2-debuginfo
openjpeg2-debugsource
openjpeg2
mingw-openjpeg2

How to mitigate CVE-2016-3183

Install updates from vendor's website.

OpenJPEG - update to 2.1.1
media-libs/openjpeg - update to 1.5.2
libopenjp2-7 - update to 2.1.0-4.15.1
libopenjp2-7-debuginfo - update to 2.1.0-4.15.1
openjpeg2-debuginfo - update to 2.1.0-4.15.1
openjpeg2-debugsource - update to 2.1.0-4.15.1
openjpeg2 - addressed in versions 2.1.1-1.fc23, 2.1.1-1.fc24
mingw-openjpeg2 - addressed in versions 2.1.1-1.fc23, 2.1.1-1.fc24

External References

Related Security Bulletins