CVE-2016-10506

MEDIUM

OpenJPEG < 2.2.0 - Denial of Service via Division-by-Zero in pi.c

Title source: llm
STIX 2.1

Description

Division-by-zero vulnerabilities in the functions opj_pi_next_cprl, opj_pi_next_pcrl, and opj_pi_next_rpcl in pi.c in OpenJPEG before 2.2.0 allow remote attackers to cause a denial of service (application crash) via crafted j2k files.

References (9)

Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/100573
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/uclouvain/openjpeg/commit/d27ccf01c68a31ad62b33d2dc1ba2bb1eeaafe7b
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201710-26
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/uclouvain/openjpeg/issues/779
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/uclouvain/openjpeg/issues/732
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/uclouvain/openjpeg/issues/780
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/uclouvain/openjpeg/issues/777
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/uclouvain/openjpeg/issues/731
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://github.com/uclouvain/openjpeg/issues/778

Scores

CVSS v3 6.5
EPSS 0.0347
EPSS Percentile 87.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE
CWE-369
Status published
Products (1)
uclouvain/openjpeg < 2.1.2
Published Aug 30, 2017
Tracked Since Feb 18, 2026