CVE-2016-5159 — Integer Overflow or Wraparound in Google Chrome

CWE-190 — Integer Overflow or WraparoundCWE-122 — Heap-based Buffer Overflow11 documents7 sources
Severity
8.8HIGHNVD
EPSS
1.5%
top 19.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
THE Openjpeg Project Openjpeg2Google ChromeOpensuse Leap
Timeline
PublishedSep 11
Latest updateMay 14

Description

Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data that is mishandled during opj_aligned_malloc calls in dwt.c and t1.c.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶Debianthe_openjpeg_project/openjpeg2< 2.1.2-1+3
▶NVDgoogle/chrome52.0.2743.116
▶NVDopensuse/leap42.1

🔴Vulnerability Details

3
GHSA
GHSA-49fh-qw2v-33hw: Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53↗2022-05-14
▶
CVEList
CVE-2016-5159: Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53↗2016-09-11
▶
OSV
CVE-2016-5159: Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53↗2016-09-11
▶

📋Vendor Advisories

2
Red Hat
openjpeg: heap overflow in parsing of JPEG2000 code blocks↗2016-08-31
▶
Debian
CVE-2016-5159: openjpeg2 - Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome befor...↗2016
▶

💬Community

5
Bugzilla
CVE-2016-5159 openjpeg2: chromium-browser, openjpeg: heap overflow in parsing of JPEG2000 code blocks [fedora-all]↗2017-03-23
▶
Bugzilla
CVE-2016-5139 CVE-2016-5158 CVE-2016-5159 openjpeg2: various flaws [epel-6]↗2017-02-16
▶
Bugzilla
CVE-2016-5139 CVE-2016-5158 CVE-2016-5159 openjpeg2: various flaws [epel-7]↗2017-02-16
▶
Bugzilla
CVE-2016-5139 CVE-2016-5158 CVE-2016-5159 openjpeg: various flaws [fedora-all]↗2017-02-16
▶
Bugzilla
CVE-2016-5159 chromium-browser, openjpeg: heap overflow in parsing of JPEG2000 code blocks↗2016-09-01
▶
CVE-2016-5159 — Integer Overflow or Wraparound | cvebase