CVE-2016-9113 Null dereference in n/a

What is CVE-2016-9113?

CVE-2016-9113 is a high-severity vulnerability in Uclouvain Openjpeg, published on 30 Oct 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

There is a NULL pointer dereference in function imagetobmp of convertbmp.c:980 of OpenJPEG 2.1.2. image->comps[0].data is not assigned a value after initialization(NULL). Impact is Denial of Service.

Weakness: CWE-476

Which versions are affected by CVE-2016-9113?

It affects 1 product.

Products include Uclouvain Openjpeg.

How do I fix CVE-2016-9113?

Apply the vendor's patch.

Is CVE-2016-9113 being exploited?

There is no known exploitation of CVE-2016-9113 in the wild and no public exploit code.

Other vulnerabilities in Uclouvain Openjpeg

• CVE-2013-4289 Integer overflow in n/a Critical 10.0
• CVE-2013-4290 Memory corruption in n/a Critical 10.0
• CVE-2012-3358 Memory corruption in n/a Critical 10.0
• CVE-2018-7648 Memory corruption in n/a Critical 9.8
• CVE-2017-17479 Memory corruption in n/a Critical 9.8

All Uclouvain Openjpeg vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2016-9113, ECHO-caea-b43f-d9b2, GHSA-j2pc-4wh8-7v7q, ROOT-OS-DEBIAN-12-CVE-2016-9113, UBUNTU-CVE-2016-9113.