CVE-2015-8871 - Vulnerability Details - OpenCVE

Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Uclouvain	Openjpeg

Configuration 1 [-]

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:a:uclouvain:openjpeg:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.debian.org/security/2016/dsa-3665
http://www.openwall.com/lists/oss-security/2015/09/15/4
http://www.openwall.com/lists/oss-security/2016/05/13/1
http://www.securitytracker.com/id/1038623
https://bugzilla.redhat.com/show_bug.cgi?id=1263359
https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md
https://github.com/uclouvain/openjpeg/commit/940100c28ae28931722290794889cf84a92c5f6f
https://github.com/uclouvain/openjpeg/issues/563
https://nvd.nist.gov/vuln/detail/CVE-2015-8871
https://security.gentoo.org/glsa/201612-26
https://www.cve.org/CVERecord?id=CVE-2015-8871

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2016-09-21T14:00:00

Updated: 2024-08-06T08:29:22.193Z

Reserved: 2016-05-12T00:00:00

Link: CVE-2015-8871

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-09-21T14:25:00.487

Modified: 2025-04-12T10:46:40.837

Link: CVE-2015-8871

Redhat

Severity : Moderate

Publid Date: 2015-09-15T00:00:00Z

Links: CVE-2015-8871 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-09-15T00:00:00", "descriptions": [{"lang": "en", "value": "Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-07T09:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "GLSA-201612-26", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201612-26"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/uclouvain/openjpeg/issues/563"}, {"name": "[oss-security] 20160512 Re: CVE Request : Use-after-free in openjpeg", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/05/13/1"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1263359"}, {"name": "DSA-3665", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2016/dsa-3665"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/uclouvain/openjpeg/commit/940100c28ae28931722290794889cf84a92c5f6f"}, {"name": "1038623", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1038623"}, {"name": "[oss-security] 20150915 CVE Request : Use-after-free in openjpeg", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2015/09/15/4"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-8871", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "GLSA-201612-26", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201612-26"}, {"name": "https://github.com/uclouvain/openjpeg/issues/563", "refsource": "CONFIRM", "url": "https://github.com/uclouvain/openjpeg/issues/563"}, {"name": "[oss-security] 20160512 Re: CVE Request : Use-after-free in openjpeg", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/05/13/1"}, {"name": "https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md", "refsource": "CONFIRM", "url": "https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1263359", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1263359"}, {"name": "DSA-3665", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2016/dsa-3665"}, {"name": "https://github.com/uclouvain/openjpeg/commit/940100c28ae28931722290794889cf84a92c5f6f", "refsource": "CONFIRM", "url": "https://github.com/uclouvain/openjpeg/commit/940100c28ae28931722290794889cf84a92c5f6f"}, {"name": "1038623", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1038623"}, {"name": "[oss-security] 20150915 CVE Request : Use-after-free in openjpeg", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/09/15/4"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T08:29:22.193Z"}, "title": "CVE Program Container", "references": [{"name": "GLSA-201612-26", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201612-26"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/uclouvain/openjpeg/issues/563"}, {"name": "[oss-security] 20160512 Re: CVE Request : Use-after-free in openjpeg", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/05/13/1"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1263359"}, {"name": "DSA-3665", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2016/dsa-3665"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/uclouvain/openjpeg/commit/940100c28ae28931722290794889cf84a92c5f6f"}, {"name": "1038623", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1038623"}, {"name": "[oss-security] 20150915 CVE Request : Use-after-free in openjpeg", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/09/15/4"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-8871", "datePublished": "2016-09-21T14:00:00", "dateReserved": "2016-05-12T00:00:00", "dateUpdated": "2024-08-06T08:29:22.193Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:uclouvain:openjpeg:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA6BA5BE-0BB1-43CD-8F99-1252CA514E6D", "versionEndIncluding": "2.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors."}, {"lang": "es", "value": "Vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n de memoria en la funci\u00f3n opj_j2k_write_mco en j2k.c en OpenJPEG en versiones anteriores a 2.1.1 permite a atacantes remotos tener impacto no especificado a trav\u00e9s de vectores desconocidos."}], "id": "CVE-2015-8871", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-09-21T14:25:00.487", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.debian.org/security/2016/dsa-3665"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2015/09/15/4"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/05/13/1"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id/1038623"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1263359"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/uclouvain/openjpeg/commit/940100c28ae28931722290794889cf84a92c5f6f"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/uclouvain/openjpeg/issues/563"}, {"source": "cve@mitre.org", "url": "https://security.gentoo.org/glsa/201612-26"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.debian.org/security/2016/dsa-3665"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2015/09/15/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/05/13/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1038623"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1263359"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/uclouvain/openjpeg/commit/940100c28ae28931722290794889cf84a92c5f6f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/uclouvain/openjpeg/issues/563"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201612-26"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}