CVE-2016-7163
Fixed in a distro release EPSS 7%
Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
Products: uclouvain openjpeg, debian_linux, fedoraproject fedora, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | openjpeg2 | 2.1.2-1 |
| Debian 13 | openjpeg2 | 2.1.2-1 |
| Debian 14 | openjpeg2 | 2.1.2-1 |
| Debian 8 | openjpeg2 | 2.1.0-2+deb8u1 |
| Red Hat Enterprise Linux 6 | openjpeg | 0:1.3-16.el6_8 |
| Red Hat Enterprise Linux 6 | openjpeg-debuginfo | 0:1.3-16.el6_8 |
| Red Hat Enterprise Linux 6 | openjpeg-devel | 0:1.3-16.el6_8 |
| Red Hat Enterprise Linux 6 | openjpeg-libs | 0:1.3-16.el6_8 |
| Red Hat Enterprise Linux 7 | openjpeg | 0:1.5.1-16.el7_3 |
| Red Hat Enterprise Linux 7 | openjpeg-debuginfo | 0:1.5.1-16.el7_3 |
| Red Hat Enterprise Linux 7 | openjpeg-devel | 0:1.5.1-16.el7_3 |
| Red Hat Enterprise Linux 7 | openjpeg-libs | 0:1.5.1-16.el7_3 |
| SUSE Linux Enterprise Desktop 12 SP2 | openjpeg2 | 2.1.0-4.3.2 |
| SUSE Linux Enterprise Desktop 12 SP3 | openjpeg2 | 2.1.0-4.3.2 |
| SUSE Linux Enterprise Server 12 SP2 | openjpeg2 | 2.1.0-4.3.2 |
| SUSE Linux Enterprise Server 12 SP3 | openjpeg2 | 2.1.0-4.3.2 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | openjpeg2 | 2.1.0-4.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | openjpeg2 | 2.1.0-4.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | openjpeg2 | 2.1.0-4.3.2 |
| SUSE Package Hub 12 | openjpeg2 | 2.1.0-6.1 |
| SUSE Package Hub 12 SP1 | openjpeg2 | 2.1.0-6.1 |
| Ubuntu 16.04 LTS | openjpeg2 | 2.1.0-2.1ubuntu0.1 |