CVE-2016-1628 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Google Chrome

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-125 — Out-of-bounds Read8 documents7 sources
Severity
6.3MEDIUMNVD
EPSS
0.9%
top 24.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
THE Openjpeg Project Openjpeg2Google ChromeDebian Linux
Timeline
PublishedFeb 21
Latest updateMay 17

Description

pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certain precision value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted JPEG 2000 image in a PDF document, related to the opj_pi_next_rpcl, opj_pi_next_pcrl, and opj_pi_next_cprl functions.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages2 packages

▶Debianthe_openjpeg_project/openjpeg2< 2.1.2-1.2+3
▶NVDgoogle/chrome48.0.2564.103

Also affects: Debian Linux 8.0

🔴Vulnerability Details

3
GHSA
GHSA-84x5-p2mg-fvmp: pi↗2022-05-17
▶
CVEList
CVE-2016-1628: pi↗2016-02-21
▶
OSV
CVE-2016-1628: pi↗2016-02-21
▶

📋Vendor Advisories

2
Red Hat
chromium-browser: out-of-bounds read in PDFium↗2016-02-09
▶
Debian
CVE-2016-1628: openjpeg2 - pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does ...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-3658 libtiff: out-of-bounds read in the TIFFWriteDirectoryTagLongLong8Array function↗2016-04-12
▶
Bugzilla
CVE-2016-1628 chromium-browser: out-of-bounds read in PDFium↗2016-02-22
▶
CVE-2016-1628 — Google Chrome vulnerability | cvebase