CVE-2016-7445
HighSummary
OpenJPEG before version 2.1.2 has a vulnerability that allows remote attackers to cause application crashes via NULL pointer dereference involving the variable s.
Risk Assessment
Attackers can exploit this vulnerability to remotely trigger application crashes, leading to service availability interruptions.
Recommendation
It is recommended to update OpenJPEG to version 2.1.2 or later to mitigate this vulnerability.
Other vulnerabilities in OpenJPEG
See all- CVE-2017-14164High
A size-validation issue was discovered in opj_j2k_write_sot in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.
- CVE-2017-14152High
A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
- CVE-2017-14151High
An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.
- CVE-2017-14041High
A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
- CVE-2017-14040High
An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact.
- CVE-2017-14039High
A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
- CVE-2016-9675High
A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045 in the openjpeg library. A crafted j2k image could cause the application to crash or potentially execute arbitrary code.
- CVE-2016-9114High
There is a NULL Pointer Access in function imagetopnm of convert.c in OpenJPEG 2.1.2. The value of image->comps[compno].data is not assigned after initialization, leading to a program crash.
- CVE-2016-9113High
There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. The image->comps[0].data is not assigned a value after initialization (NULL), leading to Denial of Service.
- CVE-2016-9112High
A floating point exception (FPE) occurs in the opj_pi_next_cprl function in OpenJPEG 2.1.2, which may lead to calculation errors, including division by zero.
Original NVD description (English source)
convert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving the variable s.