CVE-2016-1645 Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers to cause a denial of s...
HighCVSS 8.8
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers to cause a denial of service (incorrect cast and out-of-bounds write) or possibly have unspecified other impact via crafted JPEG 2000 data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Chrome | <= 49.0.2623.75 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| openSUSE leap | = 42.1 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| openSUSE suse linux enterprise server | = 12.0 | No fix listed |
References
- googlechromereleases.blogspot.com
- openSUSE-SU-2016:0817 vendor-advisory
- openSUSE-SU-2016:0818 vendor-advisory
- openSUSE-SU-2016:0828 vendor-advisory
- DSA-3513 vendor-advisory
- 84224 vdb-entry
- 1035259 vdb-entry
- www.zerodayinitiative.com
- code.google.com
- pdfium.googlesource.com