CVE-2015-8871

Published: Sep 21, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.

Affected (2)

Products: Debian: Debian Linux · Uclouvain: Openjpeg

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Uclouvain Openjpeg	Up to 2.1.0

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (18)

http://www.debian.org/security/2016/dsa-3665

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/09/15/4

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/05/13/1

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securitytracker.com/id/1038623

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=1263359

Source: cve@mitre.org

Issue Tracking

https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/uclouvain/openjpeg/commit/940100c28ae28931722290794889cf84a92c5f6f

Source: cve@mitre.org

Issue TrackingPatch

https://github.com/uclouvain/openjpeg/issues/563

Source: cve@mitre.org

Issue TrackingPatch

https://security.gentoo.org/glsa/201612-26

Source: cve@mitre.org

http://www.debian.org/security/2016/dsa-3665