Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
azure/openjpeg2 may crash when handling PNG data
published 9 years ago
Summary
The PNG handling library used by azure/openjpeg2 can crash if specially crafted text data is loaded, removed, and added again. This can cause the application to stop working unexpectedly. Upgrade to the latest version of the library or apply the vendor's patch to prevent the crash.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | openjpeg2 | <= 2.3.1-12 |
Original advisory text
CVE-2016-10087 affecting package openjpeg2 2.3.1-12
The png_set_text_2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and then adding another text chunk to the structure.
References
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Jan 2017
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-44883 · OSV
Track software like this
Free during beta