CVE-2016-5157

EUVD-2016-6108
Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
opensuseleap
42.1
googlechrome
𝑥
≤ 52.0.2743.116
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
openjpeg2
bookworm
2.5.0-2
fixed
bullseye
2.4.0-3
fixed
sid
2.5.0-2
fixed
trixie
2.5.0-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chromium-browser
precise
ignored
trusty
Fixed 53.0.2785.143-0ubuntu0.14.04.1.1142
released
xenial
Fixed 53.0.2785.143-0ubuntu0.16.04.1.1254
released
yakkety
Fixed 53.0.2785.143-0ubuntu1.1307
released
oxide-qt
precise
dne
trusty
dne
xenial
not-affected
yakkety
not-affected
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00008.html
http://lists.opensuse.org/opensuse-updates/2016-09/msg00073.html
http://rhn.redhat.com/errata/RHSA-2016-1854.html
http://www.debian.org/security/2016/dsa-3660
http://www.debian.org/security/2017/dsa-4013
http://www.openwall.com/lists/oss-security/2016/09/08/5
http://www.securityfocus.com/bid/92717
http://www.securitytracker.com/id/1036729
https://bugzilla.redhat.com/show_bug.cgi?id=1374337
https://crbug.com/632622
https://github.com/uclouvain/openjpeg/commit/e078172b1c3f98d2219c37076b238fb759c751ea
https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2T6IQAMS4W65MGP7UW5FPE22PXELTK5D/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66BWMMMWXH32J5AOGLAJGZA3GH5LZHXH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQ2IIIQSJ3J4MONBOGCG6XHLKKJX2HKM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4IRSGYMBSHCBZP23CUDIRJ3LBKH6ZJ7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYLOX7PZS3ZUHQ6RGI3M6H27B7I5ZZ26/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGKSEWWWED77Q5ZHK4OA2EKSJXLRU3MK/
https://pdfium.googlesource.com/pdfium/+/b6befb2ed2485a3805cddea86dc7574510178ea9
https://security.gentoo.org/glsa/201610-09
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00008.html
http://lists.opensuse.org/opensuse-updates/2016-09/msg00073.html
http://rhn.redhat.com/errata/RHSA-2016-1854.html
http://www.debian.org/security/2016/dsa-3660
http://www.debian.org/security/2017/dsa-4013
http://www.openwall.com/lists/oss-security/2016/09/08/5
http://www.securityfocus.com/bid/92717
http://www.securitytracker.com/id/1036729
https://bugzilla.redhat.com/show_bug.cgi?id=1374337
https://crbug.com/632622
https://github.com/uclouvain/openjpeg/commit/e078172b1c3f98d2219c37076b238fb759c751ea
https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2T6IQAMS4W65MGP7UW5FPE22PXELTK5D/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/66BWMMMWXH32J5AOGLAJGZA3GH5LZHXH/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AQ2IIIQSJ3J4MONBOGCG6XHLKKJX2HKM/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4IRSGYMBSHCBZP23CUDIRJ3LBKH6ZJ7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYLOX7PZS3ZUHQ6RGI3M6H27B7I5ZZ26/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGKSEWWWED77Q5ZHK4OA2EKSJXLRU3MK/
https://pdfium.googlesource.com/pdfium/+/b6befb2ed2485a3805cddea86dc7574510178ea9
https://security.gentoo.org/glsa/201610-09