CVE-2016-5157 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Google Chrome

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer9 documents8 sources
Severity
8.8HIGHNVD
EPSS
6.6%
top 8.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
THE Openjpeg Project Openjpeg2Google ChromeFedoraproject Fedora+1 more
Timeline
PublishedSep 11
Latest updateMay 14

Description

Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶Debianthe_openjpeg_project/openjpeg2< 2.1.2-1+3
▶NVDgoogle/chrome52.0.2743.116
▶NVDopensuse/leap42.1

Also affects: Fedora 23, 24, 25

🔴Vulnerability Details

3
GHSA
GHSA-4w78-qc97-hvjf: Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt↗2022-05-14
▶
CVEList
CVE-2016-5157: Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt↗2016-09-11
▶
OSV
CVE-2016-5157: Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt↗2016-09-11
▶

📋Vendor Advisories

2
Red Hat
chromium-browser: heap overflow in pdfium↗2016-08-31
▶
Debian
CVE-2016-5157: openjpeg2 - Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in Open...↗2016
▶

💬Community

3
HackerOne
CVE-2016-5157 OpenJPEG opj_dwt_interleave_v Out-of-Bounds Write Vulnerability↗2019-11-12
▶
Bugzilla
openjpeg: Heap buffer overflow in opj_dwt_interleave_v in dwt.c↗2016-09-08
▶
Bugzilla
CVE-2016-5157 chromium-browser: heap overflow in pdfium↗2016-09-01
▶
CVE-2016-5157 — Google Chrome vulnerability | cvebase