RHEL 6 / 7 : jasper (RHSA-2017:1208)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1208 advisory. JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard. Security Fixes: Multiple flaws were found in the way...

RedHat Update for jasper RHSA-2017:1208-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 6 / 7 : jasper (ELSA-2017-1208)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1208 advisory. - Multiple security fixes fixed by thoger: CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089 CVE-2016-2116 CVE-2016-8654...

jasper: JP2 encoder NULL pointer dereference due to uninitialized cmprof_

JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash...

jasper: heap-based buffer overflow in QMFB code in JPC codec

A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected...

jasper: integer overflow in jas_image_cmpt_create()

Double free vulnerability in the jasperimagestopload function in JasPer 1.900.17 allows remote attackers to cause a denial of service crash via a crafted JPEG 2000 image file...

jasper: use-after-free and double-free flaws in mif_process_cmpt()

Use-after-free vulnerability in the mifprocesscmpt function in libjasper/mif/mifcod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service crash via a crafted JPEG 2000 image file...

jasper: double free issue in jas_iccattrval_destroy()

Double free vulnerability in the jasiccattrvaldestroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137...

Important: Red Hat Security Advisory: jasper security update

An update for jasper is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

jasper: use-after-free / double-free in JPC encoder

A use-after-free flaw was found in the way JasPer, before version 2.0.12, decode certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash...

The vulnerabilities of programs for viewing and editing PDF files such as Adobe Reader, Adobe Acrobat, Adobe Acrobat Document Cloud, and Adobe Reader Document Cloud allow attackers to trigger service interruptions.

The vulnerability of JPEG 2000 stream parser programs for viewing and editing PDF files from Adobe Reader, Adobe Acrobat, Adobe Acrobat Document Cloud, and Adobe Reader Document Cloud is related to a memory leak. Exploiting this vulnerability can allow an attacker to cause service interruptions...

PT-2017-15552

Name of the Vulnerable Software and Affected Versions IrfanView version 4.44 Description An integer overflow vulnerability exists in the JPEG 2000 parser functionality of the affected software. This issue can be triggered by viewing a specially crafted jpeg2000 image via the application or by usi...

IrfanView JPEG 2000 Reference Tile Width Arbitrary Code Execution Vulnerability

IrfanView JPEG 2000 Reference Tile Width Arbitrary Code Execution Vulnerability Summary An exploitable integer overflow vulnerability exists in the JPEG 2000 parser functionality of IrfanView 4.44. A specially crafted jpeg2000 image can cause an integer overflow leading to wrong memory allocation...

PYSEC-2017-92

Heap-based buffer overflow in the j2kencodeentry function in Pillow 2.5.0 through 3.1.1 allows remote attackers to cause a denial of service memory corruption via a crafted Jpeg2000 file...

wePresent WiPG Multiple Vulnerabilities

wePresent WiPG devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wepresent:wipg";...

Adobe Acrobat and Reader Information Disclosure (APSB17-11: CVE-2017-3032)

An Information Disclosure exists in JPEG 2000 code-stream parser in Adobe Acrobat and Reader. This vulnerability is due to improper handling of objects in memory. Attackers can exploit the vulnerability by using the out of bounds access for information leak attacks...

CVE-2017-3033

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have a memory address leak vulnerability when handling JPEG 2000 code-stream tile data...

CVE-2017-3045

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have a memory address leak vulnerability in the JPEG 2000 parser, related to the palette box...

CVE-2017-3029

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have a memory address leak vulnerability when handling a JPEG 2000 code-stream...

CVE-2017-3046

Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have a memory address leak vulnerability in the JPEG 2000 parser, related to contiguous code-stream parsing...