alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Execution of plink to perform data exfiltration and tunneling
Matching passage: Sigma rule: Execution of plink to perform data exfiltration and tunneling. Logsource: windows / process_creation. Rule: title: Potential RDP Tunneling Via Plink id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da related: - id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d type: similar status: test description: Execution of plink to perform data exfiltration and tunneling references: - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ author: Florian Roth (Nextron Systems) date: 2022-08-04 modified: 2023-01-27 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection_a: Image|endswith: \plink.exe CommandLine|contains: :127.0.0.1:3389 selection_b1: Image|endswith: \plink.exe CommandLine|contains: :3389 selection_b2: CommandLine|contains: - ' -P 443' - ' -P 22' condition: selection_a or all of selection_b* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspber. Logsource: windows / process_creation. Rule: title: Rundll32 Spawned Via Explorer.EXE id: 1723e720-616d-4ddc-ab02-f7e3685a4713 status: test description: Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary. references: - https://redcanary.com/blog/raspberry-robin/ - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: CD_ROM_ date: 2022-05-21 modified: 2023-08-31 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \explorer.exe selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE filter_main_generic: - CommandLine|contains: ' C:\Windows\System32\' - CommandLine|endswith: ' -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-1786
Matching passage: CVE-2015-1786. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.
Near-miss passage: CVE-2015-4256. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco TelePresence IP VCR devices with software 3.0(1.27) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu90736.
Query: Suspicious Transmitted Data Manipulation execution detected on endpoint
Matching passage: T1565.002 Transmitted Data Manipulation. Tactics: impact. Description: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information. The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Near-miss passage: T1565.003 Runtime Data Manipulation. Tactics: impact. Description: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.(Citation: FireEye APT38 Oct 2018)(Citation: DOJ Lazarus Sony 2018) By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making. Adversaries may alter application binaries used to display data in order to cause runtime manipulations. Adversaries may also conduct [Change Default File Association](https://attack.mitre.org/techniques/T1546/001) and [Masquerading](https://attack.mitre.org/techniques/T1036) to cause a similar effect. The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary. For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.
Query: detection rule: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations s
Matching passage: Sigma rule: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations s. Logsource: windows / registry_set. Rule: title: ClickOnce Trust Prompt Tampering id: ac9159cc-c364-4304-8f0a-d63fc1a0aabb status: test description: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet. references: - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5 - https://learn.microsoft.com/en-us/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior author: '@SerkinValery, Nasreddine Bencherchali (Nextron Systems)' date: 2023-06-12 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel\ TargetObject|endswith: - \Internet - \LocalIntranet - \MyComputer - \TrustedSites - \UntrustedSites Details: Enabled condition: selection falsepositives: - Legitimate internal requirements. level: medium
Near-miss passage: Sigma rule: Bypasses User Account Control using a fileless method. Logsource: windows / registry_set. Rule: title: Bypass UAC Using DelegateExecute id: 46dd5308-4572-4d12-aa43-8938f0184d4f status: test description: Bypasses User Account Control using a fileless method references: - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand - https://devblogs.microsoft.com/oldnewthing/20100312-01/?p=14623 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-7---bypass-uac-using-sdclt-delegateexecute author: frack113 date: 2022-01-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \open\command\DelegateExecute Details: (Empty) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute/info.yml simulation: - type: atomic-red-team name: Bypass UAC using sdclt DelegateExecute technique: T1548.002 atomic_guid: 3be891eb-4608-4173-87e8-78b494c029b7
Query: secure coding against Improper Validation of Function Hook Arguments
Matching passage: CWE-622 Improper Validation of Function Hook Arguments. The product adds hooks to user-accessible API functions, but it does not properly validate the arguments. This could lead to resultant vulnerabilities.
Near-miss passage: CWE-1191 On-Chip Debug and Test Interface With Improper Access Control. The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.
Query: playbook for alert: Encoded PowerShell / command-line abuse matching Establish Accounts
Matching passage: Playbook for T1585 Establish Accounts. 1) Validate alert telemetry against T1585. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may create and cultivate accounts with services that can be used during targeting. Adversaries can create accounts that can be used to build a persona to further operations. Persona development consists of the development of public information, presence, history and appropriate affiliations. This development could be applied to social media, website, or other publicly available informa
Near-miss passage: Playbook for T1585.001 Social Media Accounts. Different response path focused on resource development.
Query: vulnerability: The Function apply implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat 
Matching passage: CVE-2015-6715. CWE: UNKNOWN. CVSS: 6.800000190734863. The Function apply implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-5539. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Query: vulnerability: Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).
Matching passage: CVE-2015-7898. CWE: CWE-284. CVSS: 5.5. Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).
Near-miss passage: CVE-2015-8973. CWE: CWE-284. CVSS: 8.300000190734863. xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
Query: patch priority for CVE-2015-8918
Matching passage: CVE-2015-8918. CWE: CWE-119. CVSS: 7.5. The archive_string_append function in archive_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted cab files, related to "overlapping memcpy."
Near-miss passage: CVE-2015-3111. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspecified vectors.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific ser. Logsource: windows / security. Rule: title: Metasploit Or Impacket Service Installation Via SMB PsExec id: 6fb63b40-e02a-403e-9ffd-3bcc1d749442 related: - id: 1a17ce75-ff0d-4f02-9709-2b7bb5618cf0 type: derived status: test description: Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation references: - https://bczyz1.github.io/2021/01/30/psexec.html author: Bartlomiej Czyz, Relativity date: 2021-01-21 modified: 2022-10-05 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1570 - attack.execution - attack.t1569.002 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|re: ^%systemroot%\\[a-zA-Z]{8}\.exe$ ServiceName|re: (^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$) ServiceStartType: 3 ServiceType: '0x10' filter: ServiceName: PSEXESVC condition: selection and not filter falsepositives: - Possible, different agents with a 8 character binary and a 4, 8 or 16 character service name level: high
Near-miss passage: Sigma rule: Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys. Logsource: windows / process_creation. Rule: title: Reg Add Suspicious Paths id: b7e2a8d4-74bb-4b78-adc9-3f92af2d4829 status: test description: Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.001/T1562.001.md - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2022-10-10 tags: - attack.persistence - attack.defense-impairment - attack.t1112 - attack.t1685 logsource: category: process_creation product: windows detection: selection_reg: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_path: CommandLine|contains: - \AppDataLow\Software\Microsoft\ - \Policies\Microsoft\Windows\OOBE - \Policies\Microsoft\Windows NT\CurrentVersion\Winlogon - \SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon - \CurrentControlSet\Control\SecurityProviders\WDigest - \Microsoft\Windows Defender\ condition: all of selection_* falsepositives: - Rare legitimate add to registry via cli (to these locations) level: high
Query: exploit Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified
Matching passage: CVE-2015-3073. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, and CVE-2015-3074.
Near-miss passage: CVE-2015-8275. CWE: CWE-284. CVSS: 5.5. LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files.
Query: describe CVE-2015-3101
Matching passage: CVE-2015-3101. CWE: CWE-264. CVSS: 4.300000190734863. The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, when Internet Explorer is used, allows attackers to perform a transition from Low Integrity to Medium Integrity via unspecified vectors.
Near-miss passage: CVE-2015-1661. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Query: Sigma rule for Detects potential overwriting and deletion of a file using DD.
Matching passage: Sigma rule: Detects potential overwriting and deletion of a file using DD.. Logsource: linux / process_creation. Rule: title: DD File Overwrite id: 2953194b-e33c-4859-b9e8-05948c167447 status: test description: Detects potential overwriting and deletion of a file using DD. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2022-07-07 tags: - attack.impact - attack.t1485 logsource: product: linux category: process_creation detection: selection1: Image: - /bin/dd - /usr/bin/dd selection2: CommandLine|contains: of= selection3: CommandLine|contains: - if=/dev/zero - if=/dev/null condition: all of selection* falsepositives: - Any user deleting files that way. level: low
Near-miss passage: Sigma rule: Detects the execution of the "cloudflared" binary from a non standard location.. Logsource: windows / process_creation. Rule: title: Cloudflared Portable Execution id: fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd status: test description: 'Detects the execution of the "cloudflared" binary from a non standard location. ' references: - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/ - https://github.com/cloudflare/cloudflared - https://www.intrinsec.com/akira_ransomware/ - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - https://github.com/cloudflare/cloudflared/releases author: Nasreddine Bencherchali (Nextron Systems) tags: - attack.command-and-control - attack.t1090.001 date: 2023-12-20 logsource: category: process_creation product: windows detection: selection: Image|endswith: \cloudflared.exe filter_main_admin_location: Image|contains: - :\Program Files (x86)\cloudflared\ - :\Program Files\cloudflared\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate usage of Cloudflared portable versions level: medium
Query: describe CVE-2015-7269
Matching passage: CVE-2015-7269. CWE: CWE-254. CVSS: 4.199999809265137. Seagate ST500LT015 hard disk drives, when operating in eDrive mode on Lenovo ThinkPad W541 laptops with BIOS 2.21, allow physically proximate attackers to bypass self-encrypting drive (SED) protection by attaching a second SATA connector to exposed pins, maintaining an alternate power source, and attaching the data cable to another machine, aka a "Hot Unplug Attack."
Near-miss passage: CVE-2015-1268. CWE: CWE-254. CVSS: 5.0. bindings/scripts/v8_types.py in Blink, as used in Google Chrome before 43.0.2357.130, does not properly select a creation context for a return value's DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code, as demonstrated by use of a data: URL.
Query: write Sigma for Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution
Matching passage: Sigma rule: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution. Logsource: windows / ps_module. Rule: title: SyncAppvPublishingServer Bypass Powershell Restriction - PS Module id: fe5ce7eb-dad8-467c-84a9-31ec23bd644a related: - id: fde7929d-8beb-4a4c-b922-be9974671667 type: derived - id: 9f7aa113-9da6-4a8d-907c-5f1a4b908299 type: derived status: test description: Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions. references: - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/ author: Ensar Şamil, @sblmsrsn, OSCD Community date: 2020-10-05 modified: 2022-12-02 tags: - attack.stealth - attack.t1218 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains: SyncAppvPublishingServer.exe condition: selection falsepositives: - App-V clients level: medium
Near-miss passage: Sigma rule: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility. Logsource: macos / process_creation. Rule: title: Potential Persistence Via PlistBuddy id: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb status: test description: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility references: - https://redcanary.com/blog/clipping-silver-sparrows-wings/ - https://www.manpagez.com/man/8/PlistBuddy/ author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.001 - attack.t1543.004 logsource: category: process_creation product: macos detection: selection: Image|endswith: /PlistBuddy CommandLine|contains|all: - RunAtLoad - 'true' CommandLine|contains: - LaunchAgents - LaunchDaemons condition: selection falsepositives: - Unknown level: high
Query: common weakness: ASP.NET Misconfiguration: Missing Custom Error Page
Matching passage: CWE-12 ASP.NET Misconfiguration: Missing Custom Error Page. An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.
Near-miss passage: CWE-1048 Invokable Control Element with Large Number of Outward Calls. The code contains callable control elements that contain an excessively large number of references to other application objects external to the context of the callable, i.e. a Fan-Out value that is excessively large.
Query: risk of The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizar
Matching passage: CVE-2015-2794. CWE: CWE-264. CVSS: 9.800000190734863. The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx.
Near-miss passage: CVE-2015-6768. CWE: CWE-264. CVSS: 7.5. The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6770.
Query: exploit Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7,
Matching passage: CVE-2015-0213. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims.
Near-miss passage: CVE-2015-4391. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for requests that delete reports via unspecified vectors.
Query: patch priority for CVE-2015-1060
Matching passage: CVE-2015-1060. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header.
Near-miss passage: CVE-2015-6581. CWE: UNKNOWN. CVSS: 7.5. Double free vulnerability in the opj_j2k_copy_default_tcp_and_create_tcd function in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 45.0.2454.85, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by triggering a memory-allocation failure.