CVE-2016-3182

MEDIUM

OpenJPEG < 2.1.1 - Denial of Service via Crafted JPEG 2000 File

Title source: llm
STIX 2.1

Description

The color_esycc_to_rgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of service (memory corruption) via a crafted jpeg 2000 file.

References (4)

Core 4
Core References
Mailing List, Third Party Advisory x_refsource_misc
http://www.openwall.com/lists/oss-security/2016/09/27/1
Mailing List, Third Party Advisory x_refsource_misc
http://www.openwall.com/lists/oss-security/2016/03/16/16
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1317826
Third Party Advisory x_refsource_confirm
https://github.com/uclouvain/openjpeg/issues/725

Scores

CVSS v3 5.5
EPSS 0.0149
EPSS Percentile 70.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE
CWE-119
Status published
Products (1)
uclouvain/openjpeg < 2.1.1
Published Feb 20, 2020
Tracked Since Feb 18, 2026