CVE-2016-3183 — Out-of-bounds Read in Openjpeg

CWE-125 — Out-of-bounds Read9 documents8 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 78.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
THE Openjpeg Project Openjpeg2Uclouvain Openjpeg
Timeline
PublishedFeb 3
Latest updateMay 13

Description

The sycc422_t_rgb function in common/color.c in OpenJPEG before 2.1.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted jpeg2000 file.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶Debianthe_openjpeg_project/openjpeg2< 2.1.1-1+3

Patches

Patch: www.openwall.com ↗Patch: bugzilla.redhat.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-55fp-6c46-gr3x: The sycc422_t_rgb function in common/color↗2022-05-13
▶
OSV
gnutls26 vulnerability↗2017-03-20
▶
CVEList
CVE-2016-3183: The sycc422_t_rgb function in common/color↗2017-02-03
▶
OSV
CVE-2016-3183: The sycc422_t_rgb function in common/color↗2017-02-03
▶

📋Vendor Advisories

2
Red Hat
openjpeg: Out-of-bounds read in sycc422_to_rgb function↗2016-03-14
▶
Debian
CVE-2016-3183: openjpeg2 - The sycc422_t_rgb function in common/color.c in OpenJPEG before 2.1.1 allows rem...↗2016
▶

💬Community

2
HackerOne
CVE-2016-3183 OpenJPEG sycc422_to_rgb Out-of-Bounds Read Vulnerability↗2019-11-12
▶
Bugzilla
CVE-2016-3183 openjpeg: Out-of-bounds read in sycc422_to_rgb function↗2016-03-15
▶
CVE-2016-3183 — Out-of-bounds Read in Openjpeg | cvebase