CVE-2016-5159
HighSummary
Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
Risk Assessment
This vulnerability may lead to denial of service, affecting application availability and potentially creating other unspecified threats to the system.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in OpenJPEG, PDFium, Google Chrome
See all- CVE-2016-5158High
Multiple integer overflows in OpenJPEG, used in PDFium in Google Chrome, can lead to denial of service or unspecified other impacts via crafted JPEG 2000 data.
- CVE-2016-5157High
A heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data.
- CVE-2016-5152High
Integer overflow in the opj_tcd_get_decoded_tile_size function in OpenJPEG, used in PDFium in Google Chrome, may lead to denial of service or other unspecified impacts via crafted JPEG 2000 data.
- CVE-2016-5139High
Multiple integer overflows in OpenJPEG, used in PDFium in Google Chrome before version 52.0.2743.116, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.
- CVE-2016-1645High
Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before version 49.0.2623.87, may allow remote attackers to cause a denial of service or potentially have unspecified other impact via crafted JPEG 2000 data.
- CVE-2015-6581High
A double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before version 45.0.2454.85, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering a memory-allocation failure.
- CVE-2014-7903High
Buffer overflow in OpenJPEG before r2911 in PDFium, as used in Google Chrome before version 39.0.2171.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG image.
Original NVD description (English source)
Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during opj_aligned_malloc calls in dwt.c and t1.c.