FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2016-1626

This CVE name corresponds to:

Entered	Topic
2016-02-09	chromium -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2016-1626 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2016-1626
Phase	Assigned(20160112)

Description

The opj_pi_update_decode_poc function in pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, miscalculates a certain layer index value, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PDF document.

References

Source	Reference
CONFIRM	http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html
CONFIRM	https://code.google.com/p/chromium/issues/detail?id=571480
CONFIRM	https://codereview.chromium.org/1583233008
DEBIAN	DSA-3486
SUSE	openSUSE-SU-2016:0518