CVE-2016-1645

HIGH

Google Chrome < 49.0.2623.87 - Out-of-Bounds Write via JPEG 2000 Data

Title source: llm

Description

Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers to cause a denial of service (incorrect cast and out-of-bounds write) or possibly have unspecified other impact via crafted JPEG 2000 data.

References (10)

Core 10

Core References

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00067.html

Issue Tracking x_refsource_confirm

https://code.google.com/p/chromium/issues/detail?id=587227

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00073.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1035259

Third Party Advisory x_refsource_confirm

http://www.zerodayinitiative.com/advisories/ZDI-16-197/

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3513

Release Notes, Vendor Advisory x_refsource_confirm

http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_8.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/84224

Various Sources x_refsource_confirm

https://pdfium.googlesource.com/pdfium/+/c145aeb2bf13ac408fc3e8233acca43d4251bbdc

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00066.html

Scores

CVSS v3 8.8

EPSS 0.0219

EPSS Percentile 84.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (6)

debian/debian_linux 8.0

google/chrome < 49.0.2623.75

opensuse/leap 42.1

opensuse/opensuse 13.1

opensuse/opensuse 13.2

opensuse/suse_linux_enterprise_server 12.0

Published Mar 13, 2016

Tracked Since Feb 18, 2026