CVE-2015-1239CWE-415

CVE-2015-1239

Medium · published October 18, 2017

CVSS v3.1
6.5
EPSS
1%
Percentile
63.6
In the wild
Unconfirmed
What it is

Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01038 · 63.6th percentile
Weakness
CWE-415 · Double Free
Published
2017-10-18T21:29Z
Affected products (3)
ProductVersionsFixed in
google/chromeall versions—
uclouvain/openjpeg< 2.1.12.1.1
debian/debian_linuxall versions—
References (6)
https://bugs.chromium.org/p/chromium/issues/detail?id=457493 · [email protected]https://lists.debian.org/debian-lts-announce/2018/07/msg00025.html · [email protected]https://bugs.chromium.org/p/chromium/issues/detail?id=430891 · af854a3a-2127-422b-91ae-364da2661108https://bugs.chromium.org/p/chromium/issues/detail?id=457493 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2018/07/msg00025.html · af854a3a-2127-422b-91ae-364da2661108https://bugs.chromium.org/p/chromium/issues/detail?id=430891 · [email protected]
EPSS history
Timeline
  • 18 OCT 17:00Z
    Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a…
    cvelistv5