Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-10504 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Openjpeg

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-122 — Heap-based Buffer Overflow13 documents8 sources
Severity
6.5MEDIUMNVD
EPSS
6.1%
top 9.19%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
THE Openjpeg Project Openjpeg2Uclouvain Openjpeg
Timeline
PublishedAug 30
Latest updateMay 13

Description

Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc.c in OpenJPEG before 2.2.0 allows remote attackers to cause a denial of service (application crash) via a crafted bmp file.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶Debianthe_openjpeg_project/openjpeg2< 2.2.0-1+3

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-9658-9wm2-ghj4: Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc↗2022-05-13
▶
OSV
CVE-2016-10504: Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc↗2017-08-30
▶
CVEList
CVE-2016-10504: Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc↗2017-08-30
▶

💥Exploits & PoCs

1
Exploit-DB
OpenJPEG - 'mqc.c' Heap Buffer Overflow↗2017-09-01
▶

📋Vendor Advisories

2
Red Hat
openjpeg: Heap-based buffer over-write in in opj_mqc_byteout function of mqc.c↗2017-08-30
▶
Debian
CVE-2016-10504: openjpeg2 - Heap-based buffer overflow vulnerability in the opj_mqc_byteout function in mqc....↗2016
▶

💬Community

6
Bugzilla
CVE-2016-10504 CVE-2016-10505 CVE-2016-10506 CVE-2016-10507 mingw-openjpeg: various flaws [fedora-all]↗2017-08-31
▶
Bugzilla
CVE-2016-10504 openjpeg: Heap-based buffer over-write in in opj_mqc_byteout function of mqc.c↗2017-08-31
▶
Bugzilla
CVE-2016-10504 CVE-2016-10505 CVE-2016-10506 CVE-2016-10507 openjpeg2: various flaws [epel-all]↗2017-08-31
▶
Bugzilla
CVE-2016-10504 CVE-2016-10505 CVE-2016-10506 CVE-2016-10507 openjpeg: various flaws [fedora-all]↗2017-08-31
▶
Bugzilla
CVE-2016-10504 CVE-2016-10505 CVE-2016-10506 CVE-2016-10507 openjpeg2: various flaws [fedora-all]↗2017-08-31
▶
CVE-2016-10504 — Uclouvain Openjpeg vulnerability | cvebase