CVE-2016-3182: Double Free
Double free or heap corruption vulnerability was found in opjfree function triggered by specially crafted JPEG2000 image file was found in openjpeg 2016.03.14.
CVE request (contains reproducer):
http://seclists.org/oss-sec/2016/q1/631
Other sources
The coloresycctorgb function in bin/common/color.c in OpenJPEG before 2.1.1 allows attackers to cause a denial of service (memory corruption) via a crafted jpeg 2000 file.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3182?
CVE-2016-3182 has a severity rating of medium due to the potential for denial of service from heap corruption.
What software is affected by CVE-2016-3182?
CVE-2016-3182 affects versions of OpenJPEG prior to 2.1.1.
How do I fix CVE-2016-3182?
To fix CVE-2016-3182, upgrade OpenJPEG to version 2.1.1 or later.
What kind of vulnerability is CVE-2016-3182?
CVE-2016-3182 is a double free or heap corruption vulnerability triggered by specially crafted JPEG2000 image files.
Is CVE-2016-3182 exploitable in a real-world scenario?
Yes, CVE-2016-3182 can be exploited in real-world scenarios, potentially leading to application crashes.