Published: 15/12/2011 Updated: 20/12/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote malicious users to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker segment in a JPEG2000 file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
jasper project jasper 1.900.1
suse linux enterprise server 11
fedoraproject fedora 16
canonical ubuntu linux 10.10
suse linux enterprise desktop 11
canonical ubuntu linux 11.04
canonical ubuntu linux 11.10
debian debian linux 6.0
fedoraproject fedora 15
canonical ubuntu linux 10.04
suse linux enterprise software development kit 11
oracle outside in technology 8.3.5
oracle outside in technology 8.3.7

Debian Bug report logs - #652649 jasper: Fix for CVE-2011-4516 and CVE-2011-4517 Package: jasper; Maintainer for jasper is Roland Stigge <stigge@antcomde>; Reported by: Marc Deslauriers <marcdeslauriers@ubuntucom> Date: Mon, 19 Dec 2011 15:57:02 UTC Severity: serious Tags: patch Found in version 19001-12 Fixed ...

Synopsis Important: jasper security update Type/Severity Security Advisory: Important Topic Updated jasper packages that fix two security issues are now available forRed Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerability S ...

Synopsis Important: netpbm security update Type/Severity Security Advisory: Important Topic Updated netpbm packages that fix three security issues are now availablefor Red Hat Enterprise Linux 4 and 5The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnera ...

Ghostscript could be made to crash or run programs as your login if it opened a specially crafted file ...

JasPer could be made to crash or run programs as your login if it opened a specially crafted file ...

Two heap-based buffer overflow flaws were found in the way JasPer decoded JPEG 2000 compressed image files An attacker could create a malicious JPEG 2000 compressed image file that, when opened, would cause applications that use JasPer (such as Nautilus) to crash or, potentially, execute arbitrary code ...

A heap-based buffer overflow flaw was found in the way JasPer decoded JPEG 2000 compressed image files An attacker could create a malicious JPEG 2000 compressed image file that, when opened, would cause applications that use JasPer (such as Nautilus) to crash or, potentially, execute arbitrary code ...

CWE-787 http://www.kb.cert.org/vuls/id/887409 https://bugzilla.redhat.com/show_bug.cgi?id=747726 http://secunia.com/advisories/47353 http://www.debian.org/security/2011/dsa-2371 http://secunia.com/advisories/47306 http://www.redhat.com/support/errata/RHSA-2011-1811.html http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html http://www.ubuntu.com/usn/USN-1315-1 http://www.redhat.com/support/errata/RHSA-2011-1807.html http://osvdb.org/77595 http://secunia.com/advisories/47193 http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00010.html http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071458.html http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071561.html http://www-01.ibm.com/support/docview.wss?uid=swg21660640 http://rhn.redhat.com/errata/RHSA-2015-0698.html http://www.securityfocus.com/bid/50992 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.538606 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652649 https://nvd.nist.gov https://usn.ubuntu.com/1317-1/https://www.kb.cert.org/vuls/id/887409

CVE-2011-4516

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect