CVE-2016-8654
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
- Update to 1.900.1-14ubuntu3.4
Published Updated
PatchFirst · Latest vulnerabilities
jasper vulnerabilities
Vulnerabilities published for jasper in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 39
CVE-2016-9600
JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-9591
JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer.
- Update to 1.900.1-14ubuntu3.4
Published UpdatedCVE-2015-5203
Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2015-5221
Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2017-1000050
JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-8884
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690.
- Update to 1.900.1-14ubuntu3.4
Published UpdatedCVE-2016-9396
The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-9394
The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-9393
The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-9392
The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-9391
The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-9390
The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-9389
The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure).
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-9388
The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-9387
Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-8887
The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference).
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-8885
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image.
- Update to 1.900.1-14ubuntu3.4
Published UpdatedCVE-2017-6850
The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image.
- Update to 1.900.1-14ubuntu3.5
Published UpdatedCVE-2016-10251
Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.
- Update to 1.900.1-14ubuntu3.4
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.