Veracode Vulnerability DatabaseVERACODE:6759Denial Of Service (DoS)
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
libjasper.so is vulnerable to denial of service (DoS) attacks. A malicious user can pass a JPC file to the jpc_undo_roi function in jpc_dec.c to cause an invalid memory read, crashing the application.
| CPE | Name | Operator | Version |
|---|---|---|---|
| libjasper.so | eq | 1.0.0 |
References
lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html
lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html
www.securityfocus.com/bid/95682
blogs.gentoo.org/ago/2017/01/16/jasper-invalid-memory-read-in-jpc_undo_roi-jpc_dec-c/
bugzilla.redhat.com/show_bug.cgi?id=1416069
github.com/mdadams/jasper/issues/89
security.gentoo.org/glsa/201908-03
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P