PT-2018-5098 · Openjpeg+3 · Openjpeg+3

Chunibalon · Published 2016-12-27 · Updated 2026-03-29 · CVE-2016-9581

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions openjpeg version 2.1.2

Description A heap buffer overflow issue was discovered due to an infinite loop vulnerability in the tiftoimage component of openjpeg, specifically affecting the convert 32s C1P1 function.

Recommendations For openjpeg version 2.1.2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Infinite Loop

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-835

CWE-122

Related Identifiers

ALT-PU-2017-2084

CVE-2016-9581

ECHO-64A0-BD37-0201

MGASA-2016-0426

OPENSUSE-SU-2017:2567-1

OPENSUSE-SU-2017_0155-1

OPENSUSE-SU-2017_0185-1

OPENSUSE-SU-2017_0207-1

SUSE-SU-2016:3270-1

Affected Products

Alt Linux

Debian

Suse

Openjpeg

References · 53

• 🔥 https://github.com/uclouvain/openjpeg/issues/872 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9581 · Exploit
• https://github.com/szukw000/openjpeg/commit/cadff5fb6e73398de26a92e96d3d7cac893af255 · Patch
• https://advisories.mageia.org/MGASA-2016-0426.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/FBFRC3OO5376WRT5PO5VE2JL6UB3NBO7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9581 · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0426 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2016-9581 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:2567-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9581 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2016-9581 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-9581 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9581 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-9581 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:3270-1 · Vendor Advisory