Veracode Vulnerability DatabaseVERACODE:18003Denial Of Service (DoS) Through Divide By Zero
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
JasPer is vulnerable to denial of service attacks. A remote attacker could cause an application crash via a crafted YRsiz value in a BMP image to the imginfo command. Affected by this vulnerability is the function jpc_dec_process_siz of the file libjasper/jpc/jpc_dec.c of the component imginfo.
References
www.debian.org/security/2017/dsa-3785
www.openwall.com/lists/oss-security/2016/08/23/6
www.openwall.com/lists/oss-security/2016/10/16/14
www.securityfocus.com/bid/93588
access.redhat.com/errata/RHSA-2017:1208
access.redhat.com/security/updates/classification/#important
blogs.gentoo.org/ago/2016/10/16/jasper-two-divide-by-zero-in-jpc_dec_process_siz-jpc_dec-c/
bugzilla.redhat.com/show_bug.cgi?id=1385502
github.com/mdadams/jasper/commit/d8c2604cd438c41ec72aff52c16ebd8183068020
lists.fedoraproject.org/archives/list/[email protected]/message/THLEZURI4D24PRM7SMASC5I25IAWXXTM/
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P