JasPer Denial of Service Vulnerability (CNVD-2017-01032)

JasPer is a Canadian software developer Michael Adams developed an open source implementation of the JPEG-2000 codec. A denial of service vulnerability exists in JasPer. An attacker could exploit this vulnerability to crash the application, resulting in a denial of service...

CVE-2017-5504

The jpcundoroi function in libjasper/jpc/jpcdec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service invalid memory read and crash via a crafted image...

CVE-2017-5505

The jasmatrixasl function in jasseq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service invalid memory read and crash via a crafted image...

CVE-2017-5500

libjasper/jpc/jpcdec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service crash via vectors involving left shift of a negative value...

CVE-2017-5501

Integer overflow in libjasper/jpc/jpctsfb.c in JasPer 1.900.17 allows remote attackers to cause a denial of service crash via a crafted file...

CVE-2017-5502

libjasper/jp2/jp2dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service crash via vectors involving left shift of a negative value...

CVE-2017-5503

The decclnpass function in libjasper/jpc/jpct1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service invalid memory write and crash or possibly have unspecified other impact via a crafted image...

CVE-2017-5498

libjasper/include/jasper/jasmath.h in JasPer 1.900.17 allows remote attackers to cause a denial of service crash via vectors involving left shift of a negative value...

Code injection

The jpcdectiledecode function in jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service assertion failure via a crafted file...

CVE-2016-8883

The jpcdectiledecode function in jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service assertion failure via a crafted file...

CVE-2016-8882

The jpcdectilefini function in libjasper/jpc/jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted file...

CVE-2016-8882

The jpcdectilefini function in libjasper/jpc/jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted file...

CVE-2016-8883

The jpcdectiledecode function in jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service assertion failure via a crafted file...

CVE-2016-8882

The jpcdectilefini function in libjasper/jpc/jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted file...

CVE-2016-8883

CVE-2016-8883 affects JasPer: jpc_dec_tiledecode in jpc_dec.c (pre-1.900.8) allows remote denial of service via a crafted file (assertion failure). Public advisories confirm multiple vendors released fixes (e.g., RH/CentOS, Debian LTS, Cloud Foundry USN, etc.). Remediation: upgrade JasPer to a pa...

CVE-2016-8883

The jpcdectiledecode function in jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service assertion failure via a crafted file...

CVE-2016-8882

The jpcdectilefini function in libjasper/jpc/jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted file...

CVE-2016-8882

CVE-2016-8882 affects JasPer’s libjasper: the jpc_dec_tilefini function in jpc_dec.c is vulnerable in JasPer releases before 1.900.8, allowing a crafted file to trigger a NULL pointer dereference and cause a denial of service. This is documented across multiple advisories (EulerOS, Mageia, Huawei...

CVE-2016-8883

The jpcdectiledecode function in jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service assertion failure via a crafted file...

CVE-2016-8882

The jpcdectilefini function in libjasper/jpc/jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service NULL pointer dereference and crash via a crafted file...