{"id":"CVE-2015-8871","aliases":["DEBIAN-CVE-2015-8871","DSA-3665-1","EUVD-2015-8727","GHSA-34fc-57pc-g3m4","SUSE-SU-2017:2144-1","UBUNTU-CVE-2015-8871","openSUSE-SU-2017:2567-1"],"status":"published","title":"Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1...","description":"Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03548,"percentile":0.89377,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2016-09-11T00:00:00Z","modified":"2026-09-09T07:01:46Z","fixes":[{"ecosystem":"Debian:12","package":"openjpeg2","fixed_in":["2.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openjpeg2","fixed_in":["2.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openjpeg2","fixed_in":["2.1.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"openjpeg2","fixed_in":["2.1.2-1.1+deb9u2build0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-2+deb8u1"}]}],"versions":["2.1.0-2"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-4.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1.1+deb9u2build0.1"}]}],"versions":["2.1.0-2.1","2.1.0-2.1ubuntu0.1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 12","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-6.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Package Hub 12 SP1","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-6.1"}]}],"bundled":15}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"uclouvain","product":"openjpeg"}],"references":[{"url":"https://security.gentoo.org/glsa/201612-26","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://github.com/uclouvain/openjpeg/issues/563","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/05/13/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1263359","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://www.debian.org/security/2016/dsa-3665","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/uclouvain/openjpeg/commit/940100c28ae28931722290794889cf84a92c5f6f","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"http://www.securitytracker.com/id/1038623","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/09/15/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8871"},{"url":"https://github.com/advisories/GHSA-34fc-57pc-g3m4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8871","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172144-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/979907","tags":["report"]},{"url":"https://bugzilla.suse.com/997857","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7163","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-8871","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8871","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AL7JYPSOTOZ4UZQTE7T4Y3J7RCMV7M6M/#AL7JYPSOTOZ4UZQTE7T4Y3J7RCMV7M6M","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1002414","tags":["report"]},{"url":"https://bugzilla.suse.com/1007739","tags":["report"]},{"url":"https://bugzilla.suse.com/1007740","tags":["report"]},{"url":"https://bugzilla.suse.com/1007741","tags":["report"]},{"url":"https://bugzilla.suse.com/1007742","tags":["report"]},{"url":"https://bugzilla.suse.com/1007743","tags":["report"]},{"url":"https://bugzilla.suse.com/1007744","tags":["report"]},{"url":"https://bugzilla.suse.com/1007747","tags":["report"]},{"url":"https://bugzilla.suse.com/1014543","tags":["report"]},{"url":"https://bugzilla.suse.com/1014975","tags":["report"]},{"url":"https://bugzilla.suse.com/999817","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9581","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-8871","description":"Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.","status":"published","published":"2016-09-21T14:00:00Z","modified":"2024-08-06T08:29:22.193Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-8727","description":"Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.","status":"published","published":"2016-09-21T14:00:00Z","modified":"2024-08-06T08:29:22Z","updated_at":"2026-11-03T01:57:25.869767Z"}],"ghsa":[{"id":"GHSA-34fc-57pc-g3m4","title":"Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1...","description":"Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.","status":"published","published":"2022-05-13T01:16:24Z","modified":"2023-02-01T05:04:56Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:50:11.93472Z"}],"nvd":[{"id":"CVE-2015-8871","description":"Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.","status":"published","published":"2016-09-21T14:25:00.487Z","modified":"2026-06-17T00:35:24.663Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"CVE-2015-8871","description":"Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.","status":"published","published":"2016-09-21T14:25:00Z","modified":"2026-04-10T03:45:35.677515Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8871","description":"Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.","status":"published","published":"2016-09-21T14:25:00.487Z","modified":"2026-09-09T07:01:46.124685161Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"UBUNTU-CVE-2015-8871","description":"Use-after-free vulnerability in the opj_j2k_write_mco function in j2k.c in OpenJPEG before 2.1.1 allows remote attackers to have unspecified impact via unknown vectors.","status":"published","published":"2016-09-21T14:25:00Z","modified":"2026-04-22T10:24:10.802386Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"DSA-3665-1","title":"openjpeg2 - security update","status":"published","published":"2016-09-11T00:00:00Z","modified":"2026-03-09T01:18:57.961315Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"openSUSE-SU-2017:2567-1","title":"Security update for openjpeg2","description":"This update for openjpeg2 fixes the following issues:\n\n* CVE-2016-9114: NULL Pointer Access in function imagetopnm of convert.c:1943(jp2) could lead to crash [bsc#1007740]\n* CVE-2016-9115: Heap Buffer Overflow in function imagetotga of convert.c(jp2) [bsc#1007741]\n* CVE-2016-9580, CVE-2016-9581: Possible Heap buffer overflow via integer overflow and infite loop [bsc#1014975]\n* CVE-2016-9117: NULL Pointer Access in function imagetopnm of convert.c(jp2):1289 [bsc#1007743]\n* CVE-2016-9118: Heap Buffer Overflow in function pnmtoimage of convert.c [bsc#1007744] \n* CVE-2016-9112: FPE(Floating Point Exception) in lib/openjp2/pi.c:523 [bsc#1007747] \n* CVE-2016-9116: NULL Pointer Access in function imagetopnm of convert.c:2226(jp2) [bsc#1007742]\n* CVE-2016-9113: NULL point dereference in function imagetobmp of convertbmp.c could lead to crash [bsc#1007739] \n* CVE-2016-9572 CVE-2016-9573: Insuficient check in imagetopnm() could lead to heap buffer overflow [bsc#1014543]\n* CVE-2016-8332: Malicious file in OpenJPEG JPEG2000 format  could lead to code execution [bsc#1002414] \n* CVE-2016-7445: Null pointer dereference in convert.c could lead to crash [bsc#999817] \n* CVE 2016-7163: Integer Overflow could lead to remote code execution [bsc#997857]\n* CVE 2015-8871: Use-after-free in opj_j2k_write_mco function could lead to denial of service [bsc#979907]\n\nThis update was imported from the SUSE:SLE-12-SP2:Update update project.","status":"published","published":"2017-09-25T21:34:20Z","modified":"2026-02-04T02:19:57.401918Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"SUSE-SU-2017:2144-1","title":"Security update for openjpeg2","description":"This update for openjpeg2 fixes the following issues:\n\n- CVE 2016-7163: Integer Overflow could lead to remote code execution (bsc#997857).\n\n- CVE 2015-8871: Use-after-free in opj_j2k_write_mco function could lead to denial of service (bsc#979907).\n\n\n","status":"published","published":"2017-08-11T14:58:50Z","modified":"2026-02-04T03:30:46.873258Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}