PT-2016-6260 · Opera+5 · Opera+5

Stackexploit · Published 2016-08-03 · Updated 2024-06-15 · CVE-2016-5140

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenJPEG versions prior to 52.0.2743.116 Google Chrome versions prior to 52.0.2743.116 Opera versions prior to 52.0.2743.116

Description A heap-based buffer overflow issue exists in the opj j2k read SQcd SQcc function in j2k.c in OpenJPEG. This allows remote attackers to cause a denial of service or possibly have other unspecified impacts via crafted JPEG 2000 data.

Recommendations For OpenJPEG versions prior to 52.0.2743.116, update to version 52.0.2743.116 or later to resolve the issue. For Google Chrome versions prior to 52.0.2743.116, update to version 52.0.2743.116 or later to resolve the issue. For Opera versions prior to 52.0.2743.116, update to version 52.0.2743.116 or later to resolve the issue. As a temporary workaround, consider disabling the opj j2k read SQcd SQcc function until a patch is available.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2016-2194

CVE-2016-5140

DSA-3645-1

MGASA-2016-0279

OPENSUSE-SU-2016:1982-1

OPENSUSE-SU-2016:1983-1

OPENSUSE-SU-2016_1982-1

OPENSUSE-SU-2024:10171-1

OPENSUSE-SU-2024:12948-1

RHSA-2016:1580

RHSA-2016_1580

Affected Products

Alt Linux

Google Chrome

Openjpeg

Opera

Red Hat

Suse

References · 2369

• https://osv.dev/vulnerability/DSA-3645-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-5140 · Security Note
• http://debian.org/security/2016/dsa-3645 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0279 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5140 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4KMX62M7UNRLWO4FEQ6YIMPMTKXXJV6A · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2016:1982-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0279.html · Security Note
• https://security.gentoo.org/glsa/201610-09 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2016:1983-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5140 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10171-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00005.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-5140 · Vendor Advisory