CVE-2016-9675
HighSummary
A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045 in the openjpeg library. A crafted j2k image could cause the application to crash or potentially execute arbitrary code.
Risk Assessment
The organization may be exposed to application crashes and the potential execution of malicious code, which could lead to data loss or system takeover.
Recommendation
It is recommended to update the openjpeg library to the latest version to mitigate this vulnerability and to monitor systems for unauthorized access.
Other vulnerabilities in openjpeg
See all- CVE-2017-14164High
A size-validation issue was discovered in opj_j2k_write_sot in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.
- CVE-2017-14152High
A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
- CVE-2017-14151High
An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.
- CVE-2017-14041High
A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
- CVE-2017-14040High
An invalid write access was discovered in bin/jp2/convert.c in OpenJPEG 2.2.0, triggering a crash in the tgatoimage function. The vulnerability may lead to remote denial of service or possibly unspecified other impact.
- CVE-2017-14039High
A heap-based buffer overflow was discovered in the opj_t2_encode_packet function in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly unspecified other impact.
- CVE-2016-9114High
There is a NULL Pointer Access in function imagetopnm of convert.c in OpenJPEG 2.1.2. The value of image->comps[compno].data is not assigned after initialization, leading to a program crash.
- CVE-2016-9113High
There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. The image->comps[0].data is not assigned a value after initialization (NULL), leading to Denial of Service.
- CVE-2016-9112High
A floating point exception (FPE) occurs in the opj_pi_next_cprl function in OpenJPEG 2.1.2, which may lead to calculation errors, including division by zero.
- CVE-2016-8332High
A buffer overflow in OpenJPEG 2.1.1 can lead to arbitrary code execution when parsing a crafted image. Exploiting this vulnerability requires the user to open a malicious jpeg2000 file.
Original NVD description (English source)
openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. A crafted j2k image could cause the application to crash, or potentially execute arbitrary code.