{"id":"CVE-2016-3181","aliases":["EUVD-2016-4222","GHSA-jjw9-m7w7-qm6w","MGASA-2016-0362"],"status":"rejected","title":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-3182. Reason: This candidate is a...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-3182. Reason: This candidate is a duplicate of CVE-2016-3182. Notes: All CVE users should reference CVE-2016-3182 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2016-11-03T09:02:50Z","modified":"2026-04-16T06:24:54Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"openjpeg2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-1.mga5"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:5","package":"ghostscript","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.14-3.2.mga5"}]}],"bundled":9}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3181"},{"url":"https://github.com/advisories/GHSA-jjw9-m7w7-qm6w"},{"url":"https://advisories.mageia.org/MGASA-2016-0362.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=17536","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HPMDEUIMHTLKMHELDL4F4HZ7X4Y34JEB/","tags":["web"]},{"url":"https://github.com/uclouvain/openjpeg/blob/master/CHANGELOG.md","tags":["web"]},{"url":"https://www.debian.org/security/2016/dsa-3665","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2016-09/msg00109.html","tags":["web"]},{"url":"http://www.talosintelligence.com/reports/TALOS-2016-0193/","tags":["web"]},{"url":"http://www.openjpeg.org/2016/09/28/OpenJPEG-2.1.2-released","tags":["web"]},{"url":"https://github.com/uclouvain/openjpeg/blob/openjpeg-2.1/CHANGELOG.md","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-3181","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-3182. Reason: This candidate is a duplicate of CVE-2016-3182. Notes: All CVE users should reference CVE-2016-3182 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2020-02-20T00:02:59Z","modified":"2020-03-09T17:39:41Z","updated_at":"2026-11-02T14:33:33.758954Z"}],"euvd":[{"id":"EUVD-2016-4222","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-3182. Reason: This candidate is a duplicate of CVE-2016-3182. Notes: All CVE users should reference CVE-2016-3182 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2020-02-20T00:02:59Z","modified":"2020-03-09T17:39:41Z","updated_at":"2026-11-03T03:51:24.089619Z"}],"ghsa":[{"id":"GHSA-jjw9-m7w7-qm6w","title":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-3182. Reason: This candidate is a...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-3182. Reason: This candidate is a duplicate of CVE-2016-3182. Notes: All CVE users should reference CVE-2016-3182 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.","status":"published","published":"2022-05-24T17:09:23Z","modified":"2023-01-29T05:01:45Z","updated_at":"2026-11-02T14:44:54.429174Z"}],"nvd":[{"id":"CVE-2016-3181","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-3182. Reason: This candidate is a duplicate of CVE-2016-3182. Notes: All CVE users should reference CVE-2016-3182 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2020-02-20T01:15:10.64Z","modified":"2023-11-07T02:32:12.31Z","updated_at":"2026-11-02T14:03:40.524348Z"}],"osv":[{"id":"MGASA-2016-0362","title":"Updated openjpeg2 packages fix security vulnerabilities","description":"A specially crafted JPEG2000 image file can force Out-Of-Bounds Read in\nopj_tcd_free_tile() (CVE-2016-3181).\n\nA specially crafted JPEG2000 image file can force Heap Corruption in\nopj_free() (CVE-2016-3182).\n\nA specially crafted JPEG2000 image file can force Out-Of-Bounds Read in\nsycc422_to_rgb() (CVE-2016-3183).\n\nOpenJPEG Heap Buffer Overflow in function color_cmyk_to_rgb() in color.c\n(CVE-2016-4796).\n\nOpenJPEG division-by-zero in function opj_tcd_init_tile() in tcd.c\n(CVE-2016-4797).\n\nHeap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c\nin OpenJPEG allows remote attackers to execute arbitrary code via\ncrafted coordinate values in JPEG 2000 data (CVE-2016-5157).\n\nInteger overflow in the opj_pi_create_decode function in pi.c in\nOpenJPEG allows remote attackers to execute arbitrary code via a crafted\nJP2 file, which triggers an out-of-bounds read or write (CVE-2016-7163).\n\nconvert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a\ndenial of service (NULL pointer dereference and application crash) via\nvectors involving the variable s (CVE-2016-7445).\n\nA buffer overflow in OpenJPEG 2.1.1 causes arbitrary code execution when\nparsing a crafted image. An exploitable code execution vulnerability\nexists in the jpeg2000 image file format parser as implemented in the\nOpenJpeg library. A specially crafted jpeg2000 file can cause an out of\nbound heap write resulting in heap corruption leading to arbitrary code\nexecution (CVE-2016-8332).\n","status":"published","published":"2016-11-03T09:02:50Z","modified":"2026-04-16T06:24:54.078618143Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}