CVE-2016-5139
HighSummary
Multiple integer overflows in OpenJPEG, used in PDFium in Google Chrome before version 52.0.2743.116, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
Risk Assessment
Organizations may be vulnerable to attacks leading to denial of service, which can disrupt service availability. Additionally, there is a risk of unspecified impact on systems processing JPEG 2000 data.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability. Also, monitor and restrict processing of JPEG 2000 data from untrusted sources.
Other vulnerabilities in OpenJPEG, PDFium, Google Chrome
See all- CVE-2016-5159High
Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
- CVE-2016-5158High
Multiple integer overflows in OpenJPEG, used in PDFium in Google Chrome, can lead to denial of service or unspecified other impacts via crafted JPEG 2000 data.
- CVE-2016-5157High
A heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data.
- CVE-2016-5152High
Integer overflow in the opj_tcd_get_decoded_tile_size function in OpenJPEG, used in PDFium in Google Chrome, may lead to denial of service or other unspecified impacts via crafted JPEG 2000 data.
- CVE-2016-1645High
Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before version 49.0.2623.87, may allow remote attackers to cause a denial of service or potentially have unspecified other impact via crafted JPEG 2000 data.
- CVE-2015-6581High
A double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before version 45.0.2454.85, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering a memory-allocation failure.
- CVE-2014-7903High
Buffer overflow in OpenJPEG before r2911 in PDFium, as used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG image.
Original NVD description (English source)
Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 52.0.2743.116, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.