CVE-2016-1645: Debian Linux

High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days.

Multiple integer signedness errors in the opj_j2k_update_image_data function in j2k.c in OpenJPEG, as used in PDFium in Google Chrome before 49.0.2623.87, allow remote attackers to cause a denial of service (incorrect cast and out-of-bounds write) or possibly have unspecified other impact via crafted JPEG 2000 data.

Affected products

• Debian Debian Linux: version 8.0 only
• Google Chrome: up to and including 49.0.2623.75
• Opensuse Leap: version 42.1 only
• Opensuse Opensuse: version 13.1 only; version 13.2 only
• Opensuse Suse Linux Enterprise Server: version 12.0 only

Published 2016-03-13. Last modified 2026-06-17.