CVE-2016-5637
HighSummary
The restore_tqb_pixels function in libbpg versions 0.9.5 through 0.9.7 mishandles the transquant_bypass_enable_flag value, allowing remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted BPG image, related to a 'type confusion' issue.
Risk Assessment
This vulnerability may lead to remote code execution or service disruption, posing a significant security threat to systems using libbpg.
Recommendation
It is recommended to update libbpg to the latest version to mitigate this vulnerability and to monitor systems for suspicious activity related to BPG image processing.
Other vulnerabilities in libbpg
See all- CVE-2017-13136High
The image_alloc function in bpgenc.c in libbpg version 0.9.7 has an integer overflow, resulting in an invalid malloc and NULL pointer dereference.
- CVE-2017-14796High
The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (integer underflow and application crash) or possibly have unspecified other impact via a crafted BPG file.
- CVE-2017-14795High
The hevc_write_frame function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted BPG file. The issue is related to improper interaction with hls_pcm_sample in hevc.c and put_pcm_var in hevcdsp_template.c in FFmpeg.
- CVE-2017-14734High
The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted BPG file, related to hevc_decode_init1.
Original NVD description (English source)
The restore_tqb_pixels function in libbpg 0.9.5 through 0.9.7 mishandles the transquant_bypass_enable_flag value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted BPG image, related to a "type confusion" issue.