CVE-2016-6237

The build_huffcodes function in lepton/jpgcoder.cc in Dropbox lepton 1.0 allows remote attackers to cause denial of service (out-of-bounds write) via a crafted jpeg file.

• CWE-787

• http://www.openwall.com/lists/oss-security/2016/07/17/6Mailing List, Patch, Third Party Advisory
• https://github.com/dropbox/lepton/issues/26Issue Tracking, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/07/17/6Mailing List, Patch, Third Party Advisory
• https://github.com/dropbox/lepton/issues/26Issue Tracking, Patch, Third Party Advisory

Published

Feb 2, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6231Kaspersky Safe Browser iOS before 1.7.0 does not verify X.50…
• CVE-2016-6232Directory traversal vulnerability in KArchive before 5.24, a…
• CVE-2016-6233The (1) order and (2) group methods in Zend_Db_Select in the…
• CVE-2016-6234The process_file function in lepton/jpgcoder.cc in Dropbox l…
• CVE-2016-6235The setup_imginfo_jpg function in lepton/jpgcoder.cc in Drop…
• CVE-2016-6236The setup_imginfo_jpg function in lepton/jpgcoder.cc in Drop…
• CVE-2016-6238The write_ujpg function in lepton/jpgcoder.cc in Dropbox lep…
• CVE-2016-6239The mmap extension __MAP_NOFAULT in OpenBSD 5.8 and 5.9 allo…
• CVE-2016-6240Integer truncation error in the amap_alloc function in OpenB…
• CVE-2016-6241Integer overflow in the amap_alloc1 function in OpenBSD 5.8 …
• CVE-2016-6242OpenBSD 5.8 and 5.9 allows local users to cause a denial of …
• CVE-2016-6243thrsleep in kern/kern_synch.c in OpenBSD 5.8 and 5.9 allows …