Use-after-free vulnerability in the opjj2kwritemco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.
Divide by zero vulnerability was found in function opjtcdinittile in tcd.c
Upstream patch:
https://github.com/uclouvain/openjpeg/commit/8f9cc62b3f9a1da9712329ddcedb9750d585505c
CVE request:
http://seclists.org/oss-sec/2016/q2/327
A heap buffer overflow in function colorcmyktorgb in color.c.
Upstream patch:
https://github.com/uclouvain/openjpeg/commit/162f6199c0cd3ec1c6c6dc65e41b2faab92b2d91
CVE request:
http://seclists.org/oss-sec/2016/q2/327
n our-of-bounds read vulnerability in sycc422torgb function triggered by specially crafted JPEG2000 image file was found in openjpeg version 2016.03.14.
CVE request (contains reproducer):
http://seclists.org/oss-sec/2016/q1/632