Published: 15/02/2017 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Double free vulnerability in the mem_close function in jas_stream.c in JasPer prior to 1.900.10 allows remote malicious users to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.

Vulnerable Product	Search on Vulmon	Subscribe to Product
jasper project jasper
opensuse opensuse 13.2
fedoraproject fedora 23

Synopsis Important: jasper security update Type/Severity Security Advisory: Important Topic An update for jasper is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scor ...

Debian Bug report logs - #841110 jasper: CVE-2016-8693 Package: src:jasper; Maintainer for src:jasper is Roland Stigge <stigge@antcomde>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 17 Oct 2016 18:03:01 UTC Severity: grave Tags: fixed-upstream, security, upstream Found in version jasper/19001 ...

Several security issues were fixed in JasPer ...

Multiple vulnerabilities have been discovered in the JasPer library for processing JPEG-2000 images, which may result in denial of service or the execution of arbitrary code if a malformed image is processed For the stable distribution (jessie), these problems have been fixed in version 19001-debian1-24+deb8u2 We recommend that you upgrade you ...

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files Aspecially crafted file could cause an application using JasPer to crash or,possibly, execute arbitrary code ( CVE-2016-8654, CVE-2016-9560, CVE-2016-10249,CVE-2015-5203, CVE-2015-5221, CVE-2016-1577, CVE-2016-8690, CVE-2016-8693,CVE-2016-8884, CVE-2016-8885, CVE-2016-9262, ...

A double free vulnerability was found in mem_close in jas_streamc triggered by invoking imginfo command on specially crafted image file ...

CWE-415 https://github.com/mdadams/jasper/commit/44a524e367597af58d6265ae2014468b334d0309 https://bugzilla.redhat.com/show_bug.cgi?id=1385507 https://blogs.gentoo.org/ago/2016/10/16/jasper-double-free-in-mem_close-jas_stream-c/http://www.openwall.com/lists/oss-security/2016/10/16/14 http://www.openwall.com/lists/oss-security/2016/08/23/6 http://lists.opensuse.org/opensuse-updates/2016-11/msg00010.html http://www.securityfocus.com/bid/93587 http://www.debian.org/security/2017/dsa-3785 https://access.redhat.com/errata/RHSA-2017:1208 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22FCKKHQCQ3S6TZY5G44EFDTMWOJXJRD/https://access.redhat.com/errata/RHSA-2017:1208 https://nvd.nist.gov https://usn.ubuntu.com/3295-1/

CVE-2016-8693

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect