CVE-2016-5637 The restore_tqb_pixels function in libbpg 0.9.5 through 0.9.7 mishandles the transquant_bypass_enable_flag value, which allows remote attackers to execute arbitrary code or cause a denial of service (...
HighCVSS 8.8
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The restore_tqb_pixels function in libbpg 0.9.5 through 0.9.7 mishandles the transquant_bypass_enable_flag value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted BPG image, related to a "type confusion" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libbpg project libbpg | >= 0.9.5, <= 0.9.7 | No fix listed |
| ubuntu/gst-libav1.0(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/gst-libav1.0(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/gst-libav1.0(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/gst-libav1.0(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- VU#123799 third-party-advisory us-government-resource
- 91726 third-party-advisory vdb-entry