CVE-2016-7163
published 2016-09-21CVE-2016-7163: Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which…
PriorityP343high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
7.11%
93.5th percentile
Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | openjpeg2 | < openjpeg2 2.1.2-1 (bookworm) | openjpeg2 2.1.2-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.1.2-1 | 2.1.2-1 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.1.2-1 | 2.1.2-1 |
| the_openjpeg_project | openjpeg2 | >= 0 < 2.1.2-1 | 2.1.2-1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openjpeg: Integer overflow in opj_pi_create_decode
vendor_redhat·2016-09-06·CVSS 7.8
CVE-2016-7163 [HIGH] CWE-190 openjpeg: Integer overflow in opj_pi_create_decode
openjpeg: Integer overflow in opj_pi_create_decode
Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
An integer overflow, leading to a heap buffer overflow, was found in OpenJPEG. An attacker could create a crafted JPEG2000 image that, when loaded by an application using openjpeg, could lead to a crash or, potentially, code execution.
Debian
CVE-2016-7163: openjpeg2 - Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows...
vendor_debian·2016·CVSS 7.8
CVE-2016-7163 [HIGH] CVE-2016-7163: openjpeg2 - Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows...
Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
Scope: local
bookworm: resolved (fixed in 2.1.2-1)
bullseye: resolved (fixed in 2.1.2-1)
forky: resolved (fixed in 2.1.2-1)
sid: resolved (fixed in 2.1.2-1)
trixie: resolved (fixed in 2.1.2-1)
GHSA
GHSA-jm4f-49x7-642p: Integer overflow in the opj_pi_create_decode function in pi
ghsa_unreviewed·2022-05-13
CVE-2016-7163 [HIGH] CWE-190 GHSA-jm4f-49x7-642p: Integer overflow in the opj_pi_create_decode function in pi
Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
OSV
CVE-2016-7163: Integer overflow in the opj_pi_create_decode function in pi
osv·2016-09-21·CVSS 7.8
CVE-2016-7163 [HIGH] CVE-2016-7163: Integer overflow in the opj_pi_create_decode function in pi
Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
No detection rules found.
No public exploits indexed.
HackerOne
CVE-2016-7163 OpenJPEG opj_pi_create_decode Integer Overflow Vulnerability
hackerone·2019-11-12·CVSS 7.8
CVE-2016-7163 [HIGH] CVE-2016-7163 OpenJPEG opj_pi_create_decode Integer Overflow Vulnerability
CVE-2016-7163 OpenJPEG opj_pi_create_decode Integer Overflow Vulnerability
# OpenJPEG opj_pi_create_decode Integer Overflow Vulnerability
## 1. About OpenJPEG
OpenJPEG is an open-source JPEG 2000 codec written in C language. It's widely used in lots of Linux OSes such as Ubuntu, RedHat, Debian, Fedora, and so on. The official repository of the OpenJPEG project is available at [GitHub](https://github.com/uclouvain/openjpeg).
## 2. Credit
This vulnerability was discovered by Ke Liu of Tencent's Xuanwu LAB.
## 3. Testing Environments
+ **OS**: Ubuntu
+ **OpenJPEG**: [4a2a869](https://github.com/uclouvain/openjpeg/archive/4a2a8693e5a02207a8813b02a375abdc4e43c49b.zip) (Master version before Aug/6/2016)
+ **Compiler**: Clang
+ **CFLAGS**: ``-g -O0 -fsanitize=address``
## 4. Reproduce Steps
Bugzilla
CVE-2016-7163 openjpeg: Integer overflow in opj_pi_create_decode
bugzilla·2016-09-08·CVSS 7.8
CVE-2016-7163 [HIGH] CVE-2016-7163 openjpeg: Integer overflow in opj_pi_create_decode
CVE-2016-7163 openjpeg: Integer overflow in opj_pi_create_decode
An integer overflow in opj_pi_create_decode of pi.c was found that leads to out-of-bounds read and write in opj_pi_next_cprl of pi.c.
Upstream fix:
https://github.com/uclouvain/openjpeg/commit/c16bc057ba3f125051c9966cf1f5b68a05681de4
https://github.com/uclouvain/openjpeg/commit/ef01f18dfc6780b776d0674ed3e7415c6ef54d24
CVE assignment:
http://seclists.org/oss-sec/2016/q3/442
Discussion:
Created openjpeg tracking bugs for this issue:
Affects: fedora-all [bug 1374339]
---
Created mingw-openjpeg tracking bugs for this issue:
Affects: fedora-all [bug 1374341]
---
Created openjpeg2 tracking bugs for this issue:
Affects: fedora-all [bug 1374340]
Affects: epel-all [bug 1374343]
---
Created mingw-openjpeg2 tracking bugs
Bugzilla
CVE-2016-7163 openjpeg2: various flaws [fedora-all]
bugzilla·2016-09-08·CVSS 7.8
CVE-2016-7163 [HIGH] CVE-2016-7163 openjpeg2: various flaws [fedora-all]
CVE-2016-7163 openjpeg2: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tra
Bugzilla
CVE-2016-7163 mingw-openjpeg2: various flaws [fedora-all]
bugzilla·2016-09-08·CVSS 7.8
CVE-2016-7163 [HIGH] CVE-2016-7163 mingw-openjpeg2: various flaws [fedora-all]
CVE-2016-7163 mingw-openjpeg2: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
o
Bugzilla
CVE-2016-7163 openjpeg: various flaws [fedora-all]
bugzilla·2016-09-08·CVSS 7.8
CVE-2016-7163 [HIGH] CVE-2016-7163 openjpeg: various flaws [fedora-all]
CVE-2016-7163 openjpeg: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one trac
Bugzilla
CVE-2016-7163 mingw-openjpeg: various flaws [fedora-all]
bugzilla·2016-09-08·CVSS 7.8
CVE-2016-7163 [HIGH] CVE-2016-7163 mingw-openjpeg: various flaws [fedora-all]
CVE-2016-7163 mingw-openjpeg: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
on
Bugzilla
CVE-2016-7163 openjpeg2: various flaws [epel-all]
bugzilla·2016-09-08·CVSS 7.8
CVE-2016-7163 [HIGH] CVE-2016-7163 openjpeg2: various flaws [epel-all]
CVE-2016-7163 openjpeg2: various flaws [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora EPEL. While
only
arXiv
Using a Collated Cybersecurity Dataset for Machine Learning and Artificial Intelligence
arxiv_fulltext·2021-08-05
Using a Collated Cybersecurity Dataset for Machine Learning and Artificial Intelligence
Using a Collated Cybersecurity Dataset for Machine Learning and Artificial Intelligence
Erik Hemberg
MIT CSAIL
32 Vassar Street
Cambridge
United States of America
[email protected]
Una-May O'Reilly
MIT CSAIL
32 Vassar Street
Cambridge
United States of America
[email protected]
CAPEC
CVE
CWE
## Abstract
Artificial Intelligence (AI) and Machine Learning (ML) algorithms can support the span of indicator-level, e.g. anomaly detection, to behavioral level cyber security modeling and inference. This contribution is based on a dataset named which is amalgamated from public threat and vulnerability behavioral sources. We demonstrate how can support prediction of related threat techniques and attack patterns. We also discuss other AI and ML uses of to exploit its behavioral knowle
arXiv
Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting
arxiv_fulltext·2021-02-10·CVSS 8.8
CVE-2017-11882 [HIGH] Linking Threat Tactics, Techniques, and Patterns with Defensive Weaknesses, Vulnerabilities and Affected Platform Configurations for Cyber Hunting
Top 10 Most Exploited Vulnerabilities 2016-2019
(https://us-cert.cisa.gov/ncas/alerts/aa20-133a)
.83fcdec8a329824466f140a2e6cdfeec473a9ee2 .0
longtable[]@lllllll@
& CVSS Score & Number of Tactics & Number of Techniques &
Number of CAPECs & Number of CWEs & Number of CPEs
CVE-2017-11882 & 8.55 & 0 & 0 & 12 & 1 & 4
CVE-2017-0199 & 8.55 & 0 & 0 & 0 & 0 & 9
CVE-2017-5638 & 10.0 & 1 & 3 & 51 & 1 & 53
CVE-2012-0158 & 9.3 & 0 & 0 & 3 & 1 & 29
CVE-2019-0604 & 8.65 & 1 & 3 & 51 & 1 & 4
CVE-2017-0143 & 0.0 (not listed in BRON but NVD says high severity)
& 0 & 0 & 0 & 0 & 0
CVE-2018-4878 & 8.65 & 0 & 0 & 0 & 1 & 3
CVE-2017-8759 & 8.55 & 1 & 3 & 51 & 1 & 8
CVE-2015-1641 & 9.3 & 0 & 0 & 0 & 1 & 11
CVE-2018-7600 & 8.65 & 1 & 3 & 51 & 1 & 4
longtable
4 out of Top 10 Vulnerabilities share the follow
http://rhn.redhat.com/errata/RHSA-2017-0559.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0838.htmlhttp://www.debian.org/security/2016/dsa-3665http://www.openwall.com/lists/oss-security/2016/09/08/3http://www.openwall.com/lists/oss-security/2016/09/08/6http://www.securityfocus.com/bid/92897https://github.com/uclouvain/openjpeg/commit/c16bc057ba3f125051c9966cf1f5b68a05681de4https://github.com/uclouvain/openjpeg/commit/ef01f18dfc6780b776d0674ed3e7415c6ef54d24https://github.com/uclouvain/openjpeg/issues/826https://github.com/uclouvain/openjpeg/pull/809https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2T6IQAMS4W65MGP7UW5FPE22PXELTK5D/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66BWMMMWXH32J5AOGLAJGZA3GH5LZHXH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQ2IIIQSJ3J4MONBOGCG6XHLKKJX2HKM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4IRSGYMBSHCBZP23CUDIRJ3LBKH6ZJ7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYLOX7PZS3ZUHQ6RGI3M6H27B7I5ZZ26/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGKSEWWWED77Q5ZHK4OA2EKSJXLRU3MK/http://rhn.redhat.com/errata/RHSA-2017-0559.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0838.htmlhttp://www.debian.org/security/2016/dsa-3665http://www.openwall.com/lists/oss-security/2016/09/08/3http://www.openwall.com/lists/oss-security/2016/09/08/6http://www.securityfocus.com/bid/92897https://github.com/uclouvain/openjpeg/commit/c16bc057ba3f125051c9966cf1f5b68a05681de4https://github.com/uclouvain/openjpeg/commit/ef01f18dfc6780b776d0674ed3e7415c6ef54d24https://github.com/uclouvain/openjpeg/issues/826https://github.com/uclouvain/openjpeg/pull/809https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2T6IQAMS4W65MGP7UW5FPE22PXELTK5D/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66BWMMMWXH32J5AOGLAJGZA3GH5LZHXH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQ2IIIQSJ3J4MONBOGCG6XHLKKJX2HKM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4IRSGYMBSHCBZP23CUDIRJ3LBKH6ZJ7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYLOX7PZS3ZUHQ6RGI3M6H27B7I5ZZ26/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGKSEWWWED77Q5ZHK4OA2EKSJXLRU3MK/
2016-09-21
Published