CVE-2016-7163

moderate-risk

Published 2016-09-21

Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.

Do I need to act?

0.51% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (20)

Openjpeg

Debian Linux

Fedora

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Fedora

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server Aus

Affected Vendors

Redhat Uclouvain Fedoraproject Debian

References (32)

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0559.html

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0838.html

Third Party Advisory http://www.debian.org/security/2016/dsa-3665

Mailing List http://www.openwall.com/lists/oss-security/2016/09/08/3

Mailing List http://www.openwall.com/lists/oss-security/2016/09/08/6

Third Party Advisory http://www.securityfocus.com/bid/92897

Issue Tracking https://github.com/uclouvain/openjpeg/commit/c16bc057ba3f125051c9966cf1f5b68a056...

Issue Tracking https://github.com/uclouvain/openjpeg/commit/ef01f18dfc6780b776d0674ed3e7415c6ef...

Exploit https://github.com/uclouvain/openjpeg/issues/826

Issue Tracking https://github.com/uclouvain/openjpeg/pull/809

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0559.html

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0838.html

Third Party Advisory http://www.debian.org/security/2016/dsa-3665

Mailing List http://www.openwall.com/lists/oss-security/2016/09/08/3

and 12 more references

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 2/34 · Minimal

Exposure 20/34 · Moderate