PT-2016-7246 · Openjpeg+4 · Openjpeg+4

Ke Liu · Published 2016-09-11 · Updated 2022-04-07 · CVE-2016-7163

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenJPEG (affected versions not specified)

Description The issue is related to an integer overflow in the opj pi create decode function, which can be triggered by a crafted JP2 file. This can lead to an out-of-bounds read or write, potentially allowing remote attackers to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2017-2084

CESA-2017_0559

CESA-2017_0838

CVE-2016-7163

DSA-3665-1

MGASA-2016-0362

MGASA-2017-0122

OPENSUSE-SU-2017:2567-1

OPENSUSE-SU-2017_2186-1

RHSA-2017:0559

RHSA-2017:0838

RHSA-2017_0559

RHSA-2017_0838

SUSE-SU-2017:2144-1

Affected Products

Alt Linux

Centos

Openjpeg

Red Hat

Suse

References · 72

• 🔥 https://github.com/uclouvain/openjpeg/issues/826 · Exploit
• https://github.com/uclouvain/openjpeg/commit/ef01f18dfc6780b776d0674ed3e7415c6ef54d24 · Patch
• https://github.com/uclouvain/openjpeg/commit/c16bc057ba3f125051c9966cf1f5b68a05681de4 · Patch
• https://github.com/uclouvain/openjpeg/pull/809 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4IRSGYMBSHCBZP23CUDIRJ3LBKH6ZJ7 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGKSEWWWED77Q5ZHK4OA2EKSJXLRU3MK · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2T6IQAMS4W65MGP7UW5FPE22PXELTK5D · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-7163 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7163 · Vendor Advisory
• http://debian.org/security/2016/dsa-3665 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3665-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0122.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7163 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQ2IIIQSJ3J4MONBOGCG6XHLKKJX2HKM · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66BWMMMWXH32J5AOGLAJGZA3GH5LZHXH · Vendor Advisory