jasper: insufficient SIZ marker segment data sanity checks

The jpcpinextrpcl function in jpct2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service assertion failure via a crafted file...

jasper: insufficient SIZ marker segment data sanity checks

The jasseq2dcreate function in jasseq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service assertion failure via a crafted file...

jasper: missing jas_matrix_create() parameter checks

The bmpgetdata function in libjasper/bmp/bmpdec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted BMP image in an imginfo command...

jasper: integer overflow in jpc_dec_process_siz()

Integer overflow in the jpcdecprocesssiz function in libjasper/jpc/jpcdec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure...

jasper: missing SIZ marker segment XRsiz and YRsiz fields range check

The jpcdecprocesssiz function in libjasper/jpc/jpcdec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted YRsiz value in a BMP image to the imginfo command...

jasper: missing jas_matrix_create() parameter checks

The bmpgetdata function in libjasper/bmp/bmpdec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service NULL pointer dereference by calling the imginfo command with a crafted BMP image...

jasper: stack-based buffer overflow in jpc_dec_tileinit()

Stack-based buffer overflow in the jpctsfbgetbands2 function in jpctsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image...

jasper: reachable assertions in RAS encoder/decoder

The rasgetcmap function in rasdec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service assertion failure via a crafted image file...

jasper: reachable asserts in jpc_dec_tiledecode()

The jpcdectiledecode function in jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service assertion failure via a crafted file...

jasper: missing SIZ marker segment XRsiz and YRsiz fields range check

The jpcdecprocesssiz function in libjasper/jpc/jpcdec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a crafted XRsiz value in a BMP image to the imginfo command...

jasper: insufficient SIZ marker tilexoff and tileyoff checks

The jasseq2dcreate function in jasseq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service assertion failure via a crafted image file...

jasper: JP2 encoder NULL pointer dereference due to uninitialized cmprof_

JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash...

jasper: integer overflow in jas_matrix_create()

Integer overflow in the jpcdectiledecode function in jpcdec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted image file, which triggers a heap-based buffer overflow...

jasper: integer overflow in jpc_pi_nextcprl(), leading to out-of-bounds read

Integer overflow in the jpcpinextcprl function in jpct2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value...

jasper: out-of-bounds read in jpc_pi_nextcprl()

The jpcpinextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service out-of-bounds read and application crash via a crafted JPEG 2000 image...

Important: Red Hat Security Advisory: jasper security update

An update for jasper is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

jasper: heap-based buffer overflow in QMFB code in JPC codec

A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected...

jasper: integer truncation in jas_image_cmpt_create()

Multiple integer overflows in the 1 jasrealloc function in base/jasmalloc.c and 2 memresize function in base/jasstream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities...

jasper: integer overflow in jas_image_cmpt_create()

Double free vulnerability in the jasperimagestopload function in JasPer 1.900.17 allows remote attackers to cause a denial of service crash via a crafted JPEG 2000 image file...

jasper: insufficient SIZ marker segment data sanity checks

The calcstepsizes function in jpcdec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service assertion failure via a crafted file...