CVSS: 5.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-8883 – jasper: reachable asserts in jpc_dec_tiledecode()
https://notcve.org/view.php?id=CVE-2016-8883
The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. La función jpc_dec_tiledecode en jpc_dec.c en JasPer en versiones anteriores a 1.900.8 permite a atacantes remotos provocar una denegación de servicio (fallo de aserción) a través de un archivo manipulado. • http://www.openwall.com/lists/oss-security/2016/10/17/1 http://www.openwall.com/lists/oss-security/2016/10/23/8 http://www.securityfocus.com/bid/95865 https://access.redhat.com/errata/RHSA-2017:1208 https://github.com/mdadams/jasper/issues/32 https://usn.ubuntu.com/3693-1 https://access.redhat.com/security/cve/CVE-2016-8883 https://bugzilla.redhat.com/show_bug.cgi?id=1388870 • CWE-399: Resource Management Errors CWE-617: Reachable Assertion •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 0CVE-2016-2116 – jasper: memory leak in jas_iccprof_createfrombuf()
https://notcve.org/view.php?id=CVE-2016-2116
Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file. Fuga de memoria en la función jas_iccprof_createfrombuf en JasPer 1.900.1 y versiones anteriores permite a atacantes remotos provocar una denegación de servicio (consumo de memoria) a través de un perfil de color ICC en un archivo de imagen JPEG2000. • http://www.debian.org/security/2016/dsa-3508 http://www.openwall.com/lists/oss-security/2016/03/03/12 http://www.securityfocus.com/bid/84133 http://www.ubuntu.com/usn/USN-2919-1 https://access.redhat.com/errata/RHSA-2017:1208 https://bugs.launchpad.net/ubuntu/+source/jasper/+bug/1547865 https://access.redhat.com/security/cve/CVE-2016-2116 https://bugzilla.redhat.com/show_bug.cgi?id=1314472 • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.6EPSS: 3%CPEs: 4EXPL: 0CVE-2016-1577 – jasper: double free issue in jas_iccattrval_destroy()
https://notcve.org/view.php?id=CVE-2016-1577
Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137. Vulnerabilidad de liberación doble en la función jas_iccattrval_destroy en JasPer 1.900.1 y versiones anteriores permite a atacantes remotos provocar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de un perfil de color ICC en un archivo de imagen JPEG 2000, una vulnerabilidad diferente a CVE-2014-8137. • http://www.debian.org/security/2016/dsa-3508 http://www.openwall.com/lists/oss-security/2016/03/03/12 http://www.securityfocus.com/bid/84133 http://www.ubuntu.com/usn/USN-2919-1 https://access.redhat.com/errata/RHSA-2017:1208 https://bugs.launchpad.net/ubuntu/+source/jasper/+bug/1547865 https://access.redhat.com/security/cve/CVE-2016-1577 https://bugzilla.redhat.com/show_bug.cgi?id=1314466 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 2%CPEs: 1EXPL: 0CVE-2016-2089 – jasper: matrix rows_ NULL pointer dereference in jas_matrix_clip()
https://notcve.org/view.php?id=CVE-2016-2089
The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image. La función jas_matrix_clip en jas_seq.c en JasPer 1.900.1 permite a atacantes remotos causar una denegación de servicio (lectura inválida y caída de aplicación) a través de una imagen JPEG 2000 manipulada. • http://lists.opensuse.org/opensuse-updates/2016-02/msg00060.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00063.html http://www.debian.org/security/2016/dsa-3508 http://www.openwall.com/lists/oss-security/2016/01/28/4 http://www.openwall.com/lists/oss-security/2016/01/28/6 http://www.securityfocus.com/bid/83108 https://access.redhat.com/errata/RHSA-2017:1208 https://access.redhat.com/security/cve/CVE-2016-2089 https://bugzilla.redhat.com/show_bug.c • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-1867 – jasper: out-of-bounds read in jpc_pi_nextcprl()
https://notcve.org/view.php?id=CVE-2016-1867
The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image. La función jpc_pi_nextcprl en JasPer 1.900.1 permite a atacantes remotos provocar una denegación de servicio (lectura fuera de rango y caída de aplicación) a través de una imagen JPEG 2000 manipulada. • http://www.debian.org/security/2017/dsa-3785 http://www.openwall.com/lists/oss-security/2016/01/13/2 http://www.openwall.com/lists/oss-security/2016/01/13/6 http://www.securityfocus.com/bid/81488 https://access.redhat.com/errata/RHSA-2017:1208 https://access.redhat.com/security/cve/CVE-2016-1867 https://bugzilla.redhat.com/show_bug.cgi?id=1298135 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •