PT-2015-1985 · Google+3 · Google Chrome+3
Swift Rhino
·
Published
2015-08-29
·
Updated
2016-12-22
·
CVE-2015-6581
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
OpenJPEG versions prior to r3002
Google Chrome versions prior to 45.0.2454.85
Description
The issue is related to a double free vulnerability in the
opj j2k copy default tcp and create tcd function in j2k.c in OpenJPEG. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering a memory-allocation failure. The vulnerability is exploited by triggering a memory-allocation failure, which can lead to heap memory corruption.Recommendations
For OpenJPEG versions prior to r3002, update to version r3002 or later to resolve the issue.
For Google Chrome versions prior to 45.0.2454.85, update to version 45.0.2454.85 or later to resolve the issue.
As a temporary workaround, consider disabling the
opj j2k copy default tcp and create tcd function until a patch is available.Fix
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Google Chrome
Openjpeg
Opera