CVSS: 7.8EPSS: 2%CPEs: 3EXPL: 2CVE-2016-8693 – jasper: incorrect handling of bufsize 0 in mem_resize()
https://notcve.org/view.php?id=CVE-2016-8693
15 Feb 2017 — Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command. Vulnerabilidad de liberación doble en la función mem_close en jas_stream.c en JasPer en versiones anteriores a 1.900.10 permite a atacantes remotos provocar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de una imagen BMP manipulada al... • http://lists.opensuse.org/opensuse-updates/2016-11/msg00010.html • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2016-8692 – jasper: missing SIZ marker segment XRsiz and YRsiz fields range check
https://notcve.org/view.php?id=CVE-2016-8692
15 Feb 2017 — The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command. La función jpc_dec_process_siz en libjasper/jpc/jpc_dec.c en JasPer en versiones anteriores a 1.900.4 permite a atacantes remotos provocar una denegación de servicio (error de división por cero y bloqueo de la aplicación) a través de un valor YRsiz manipulado en u... • http://www.debian.org/security/2017/dsa-3785 • CWE-369: Divide By Zero •
CVSS: 5.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-8883 – jasper: reachable asserts in jpc_dec_tiledecode()
https://notcve.org/view.php?id=CVE-2016-8883
13 Jan 2017 — The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. La función jpc_dec_tiledecode en jpc_dec.c en JasPer en versiones anteriores a 1.900.8 permite a atacantes remotos provocar una denegación de servicio (fallo de aserción) a través de un archivo manipulado. It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or automated system using JasPer were tric... • http://www.openwall.com/lists/oss-security/2016/10/17/1 • CWE-399: Resource Management Errors CWE-617: Reachable Assertion •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-8882 – Ubuntu Security Notice USN-3295-1
https://notcve.org/view.php?id=CVE-2016-8882
13 Jan 2017 — The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file. La función jpc_dec_tilefini en libjasper/jpc/jpc_dec.c en JasPer en versiones anteriores a 1.900.8 permite a atacantes remotos provocar una denegación de servicio (referencia a puntero NULL y caída) a través de un archivo manipulado. It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image fi... • http://www.debian.org/security/2017/dsa-3785 • CWE-476: NULL Pointer Dereference •
CVSS: 7.6EPSS: 3%CPEs: 4EXPL: 0CVE-2016-1577 – jasper: double free issue in jas_iccattrval_destroy()
https://notcve.org/view.php?id=CVE-2016-1577
03 Mar 2016 — Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137. Vulnerabilidad de liberación doble en la función jas_iccattrval_destroy en JasPer 1.900.1 y versiones anteriores permite a atacantes remotos provocar una denegación de servicio (caída) o posiblemente ejecutar código ... • http://www.debian.org/security/2016/dsa-3508 • CWE-416: Use After Free •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 0CVE-2016-2116 – jasper: memory leak in jas_iccprof_createfrombuf()
https://notcve.org/view.php?id=CVE-2016-2116
03 Mar 2016 — Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file. Fuga de memoria en la función jas_iccprof_createfrombuf en JasPer 1.900.1 y versiones anteriores permite a atacantes remotos provocar una denegación de servicio (consumo de memoria) a través de un perfil de color ICC en un archivo de imagen JPEG2000. Jacob Baines discovered that JasPer incorrec... • http://www.debian.org/security/2016/dsa-3508 • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.5EPSS: 2%CPEs: 1EXPL: 0CVE-2016-2089 – jasper: matrix rows_ NULL pointer dereference in jas_matrix_clip()
https://notcve.org/view.php?id=CVE-2016-2089
08 Feb 2016 — The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image. La función jas_matrix_clip en jas_seq.c en JasPer 1.900.1 permite a atacantes remotos causar una denegación de servicio (lectura inválida y caída de aplicación) a través de una imagen JPEG 2000 manipulada. It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or automated system usin... • http://lists.opensuse.org/opensuse-updates/2016-02/msg00060.html • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-1867 – jasper: out-of-bounds read in jpc_pi_nextcprl()
https://notcve.org/view.php?id=CVE-2016-1867
20 Jan 2016 — The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image. La función jpc_pi_nextcprl en JasPer 1.900.1 permite a atacantes remotos provocar una denegación de servicio (lectura fuera de rango y caída de aplicación) a través de una imagen JPEG 2000 manipulada. It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or automated system using JasPer wer... • http://www.debian.org/security/2017/dsa-3785 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 6%CPEs: 6EXPL: 0CVE-2014-8157 – jasper: dec->numtiles off-by-one check in jpc_dec_process_sot() (oCERT-2015-001)
https://notcve.org/view.php?id=CVE-2014-8157
22 Jan 2015 — Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow. Error de superación de límite (off-by-one) en la función jpc_dec_process_sot en JasPer 1.900.1 y anteriores permite a atacantes remotos causar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de una imagen JPEG 2000 mani... • http://advisories.mageia.org/MGASA-2015-0038.html • CWE-122: Heap-based Buffer Overflow CWE-189: Numeric Errors •
CVSS: 7.8EPSS: 5%CPEs: 6EXPL: 0CVE-2014-8158 – jasper: unrestricted stack memory use in jpc_qmfb.c (oCERT-2015-001)
https://notcve.org/view.php?id=CVE-2014-8158
22 Jan 2015 — Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image. Múltiples desbordamientos de buffer basado en pila en jpc_qmfb.c en JasPer 1.900.1 y anteriores permiten a atacantes remotos causar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de una imagen JPEG 2000 manipulada. An unrestricted stack memory use flaw was found in... • http://advisories.mageia.org/MGASA-2015-0038.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-770: Allocation of Resources Without Limits or Throttling •