Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 101

Export CSV
CVE-2016-8691

jasper: missing SIZ marker segment XRsiz and YRsiz fields range check

The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command.

CVSS 3.0 · 5.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Debian Fedoraproject Jasper Project and 1 more
Products
Debian Linux Fedora Jasper and 1 more
CVE-2016-8693

jasper: incorrect handling of bufsize 0 in mem_resize()

Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.

CVSS 3.0 · 7.8 High EPSS 3.3% KEV · Not listed
Vendors
Fedoraproject Jasper Project Opensuse and 1 more
Products
Fedora Jasper Opensuse and 1 more
CVE-2016-8882

jasper: uninitialized tile->pi pointer use in JPC decoder

The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.

CVSS 3.0 · 5.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Jasper Project
Products
Jasper
CVE-2016-8883

jasper: reachable asserts in jpc_dec_tiledecode()

The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.

CVSS 3.0 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Jasper Project Redhat
Products
Jasper Enterprise Linux
CVE-2016-8884

jasper: missing jas_matrix_create() parameter checks

The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690.

CVSS 3.0 · 5.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Fedoraproject Jasper Project Redhat
Products
Fedora Jasper Enterprise Linux
CVE-2016-8885

jasper: missing jas_matrix_create() parameter checks

The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image.

CVSS 3.0 · 5.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Jasper Project Redhat
Products
Jasper Enterprise Linux
CVE-2016-8886

jasper: no upper limit on memory allocations in jas_malloc()

The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers to have unspecified impact via a crafted file, which triggers a memory allocation failure.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed
Vendors
Jasper Project
Products
Jasper
CVE-2016-8887

jasper: uninitialized pointer use in jp2_box_get()

The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference).

CVSS 3.0 · 5.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Fedoraproject Jasper Project
Products
Fedora Jasper
CVE-2016-9262

jasper: integer truncation in jas_image_cmpt_create()

Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities.

CVSS 3.0 · 5.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Jasper Project Redhat
Products
Jasper Enterprise Linux
CVE-2017-1000050

jasper: NULL pointer exception in jp2_encode()

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Canonical Fedoraproject Jasper Project and 1 more
Products
Ubuntu Linux Fedora Jasper and 4 more
CVE-2017-13746

jasper: reachable assertion in jpc_dec_process_siz() - dec->numvtiles

There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer 2.0.12 that will lead to a remote denial of service attack.

CVSS 3.1 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Fedoraproject Jasper Project
Products
Fedora Jasper
CVE-2017-13747

jasper: reachable assertion in jpc_floorlog2()

There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12 that will lead to a remote denial of service attack.

CVSS 3.1 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Fedoraproject Jasper Project
Products
Fedora Jasper
CVE-2017-13749

jasper: reachable assertion in jpc_pi_nextrpcl()

There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack.

CVSS 3.1 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Fedoraproject Jasper Project
Products
Fedora Jasper
CVE-2017-13750

jasper: reachable assertion in jpc_dec_process_siz() - dec->numhtiles

There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer 2.0.12 that will lead to a remote denial of service attack.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed
Vendors
Fedoraproject Jasper Project
Products
Fedora Jasper
CVE-2017-13751

jasper: reachable assertion in calcstepsizes()

There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.

CVSS 3.1 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Fedoraproject Jasper Project
Products
Fedora Jasper
CVE-2017-13752

jasper: reachable assertion in jpc_dequantize()

There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.

CVSS 3.1 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Fedoraproject Jasper Project
Products
Fedora Jasper
CVE-2017-14132

jasper: heap-based buffer over-read in jas_image_ishomosamp()

JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, related to the jas_image_ishomosamp function in libjasper/base/jas_image.c.

CVSS 3.0 · 6.5 Medium EPSS 2.2% KEV · Not listed
Vendors
Debian Jasper Project
Products
Debian Linux Jasper
CVE-2017-14229

jasper: excessive looping in jpc_dec_tileinit()

There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of Jasper 2.0.13. It will lead to a remote denial of service attack.

CVSS 3.0 · 7.5 High EPSS 3.0% KEV · Not listed
Vendors
Jasper Project
Products
Jasper
CVE-2017-5503

jasper: invalid memory write in dec_clnpass()

The dec_clnpass function in libjasper/jpc/jpc_t1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via a crafted image.

CVSS 3.0 · 5.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Jasper Project
Products
Jasper