CVE-2016-7163: Integer Overflow
Published Sep 21, 2016
·Updated
Integer overflow in the opjpicreatedecode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
Affected Software
22 affected components
uclouvain openjpeg<2.2.0
Debian Debian Linux=8.0
Fedoraproject Fedora=23
Fedoraproject Fedora=24
Fedoraproject Fedora=25
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Eus=7.3
redhat Enterprise Linux Eus=7.4
redhat Enterprise Linux Eus=7.5
redhat Enterprise Linux Eus=7.6
redhat Enterprise Linux Eus=7.7
redhat Enterprise Linux Server=6.0
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Server Aus=7.3
redhat Enterprise Linux Server Aus=7.4
redhat Enterprise Linux Server Aus=7.6
redhat Enterprise Linux Server Aus=7.7
redhat Enterprise Linux Server Tus=7.3
redhat Enterprise Linux Server Tus=7.6
redhat Enterprise Linux Server Tus=7.7
redhat Enterprise Linux Workstation=6.0
redhat Enterprise Linux Workstation=7.0
Remediation
Patch Available
Patch Available
Event History
Sep 21, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-7163?
CVE-2016-7163 is classified as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2016-7163?
To fix CVE-2016-7163, update OpenJPEG to version 2.2.0 or later, or apply relevant patches provided by your operating system vendor.
3
What type of attack does CVE-2016-7163 enable?
CVE-2016-7163 allows remote attackers to execute arbitrary code through a crafted JP2 file.
4
Which software versions are affected by CVE-2016-7163?
CVE-2016-7163 affects OpenJPEG versions earlier than 2.2.0 and several versions of Debian and Fedora systems.
5
Can CVE-2016-7163 lead to data loss?
Yes, CVE-2016-7163 can result in data loss or corruption due to unauthorized arbitrary code execution.