CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2016-8691 – jasper: missing SIZ marker segment XRsiz and YRsiz fields range check
https://notcve.org/view.php?id=CVE-2016-8691
The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command. La función jpc_dec_process_siz en libjasper/jpc/jpc_dec.c en JasPer en versiones anteriores a 1.900.4 permite a atacantes remotos provocar una denegación de servicio (error de división por cero y bloqueo de la aplicación) a través de un valor XRsiz manipulado en una imagen BMP al comando imginfo. • http://www.debian.org/security/2017/dsa-3785 http://www.openwall.com/lists/oss-security/2016/08/23/6 http://www.openwall.com/lists/oss-security/2016/10/16/14 http://www.securityfocus.com/bid/93593 https://access.redhat.com/errata/RHSA-2017:1208 https://blogs.gentoo.org/ago/2016/10/16/jasper-two-divide-by-zero-in-jpc_dec_process_siz-jpc_dec-c https://bugzilla.redhat.com/show_bug.cgi?id=1385502 https://github.com/mdadams/jasper/commit/d8c2604cd438c41ec72aff52c16ebd8183 • CWE-369: Divide By Zero •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 2CVE-2016-8693 – jasper: incorrect handling of bufsize 0 in mem_resize()
https://notcve.org/view.php?id=CVE-2016-8693
Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command. Vulnerabilidad de liberación doble en la función mem_close en jas_stream.c en JasPer en versiones anteriores a 1.900.10 permite a atacantes remotos provocar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de una imagen BMP manipulada al comando imginfo. • http://lists.opensuse.org/opensuse-updates/2016-11/msg00010.html http://www.debian.org/security/2017/dsa-3785 http://www.openwall.com/lists/oss-security/2016/08/23/6 http://www.openwall.com/lists/oss-security/2016/10/16/14 http://www.securityfocus.com/bid/93587 https://access.redhat.com/errata/RHSA-2017:1208 https://blogs.gentoo.org/ago/2016/10/16/jasper-double-free-in-mem_close-jas_stream-c https://bugzilla.redhat.com/show_bug.cgi?id=1385507 https://git • CWE-415: Double Free CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2016-8882
https://notcve.org/view.php?id=CVE-2016-8882
The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file. La función jpc_dec_tilefini en libjasper/jpc/jpc_dec.c en JasPer en versiones anteriores a 1.900.8 permite a atacantes remotos provocar una denegación de servicio (referencia a puntero NULL y caída) a través de un archivo manipulado. • http://www.debian.org/security/2017/dsa-3785 http://www.openwall.com/lists/oss-security/2016/10/17/1 http://www.openwall.com/lists/oss-security/2016/10/23/8 http://www.securityfocus.com/bid/95864 https://github.com/mdadams/jasper/issues/30 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-8883 – jasper: reachable asserts in jpc_dec_tiledecode()
https://notcve.org/view.php?id=CVE-2016-8883
The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. La función jpc_dec_tiledecode en jpc_dec.c en JasPer en versiones anteriores a 1.900.8 permite a atacantes remotos provocar una denegación de servicio (fallo de aserción) a través de un archivo manipulado. • http://www.openwall.com/lists/oss-security/2016/10/17/1 http://www.openwall.com/lists/oss-security/2016/10/23/8 http://www.securityfocus.com/bid/95865 https://access.redhat.com/errata/RHSA-2017:1208 https://github.com/mdadams/jasper/issues/32 https://usn.ubuntu.com/3693-1 https://access.redhat.com/security/cve/CVE-2016-8883 https://bugzilla.redhat.com/show_bug.cgi?id=1388870 • CWE-399: Resource Management Errors CWE-617: Reachable Assertion •
CVSS: 5.7EPSS: 0%CPEs: 4EXPL: 0CVE-2016-2116 – jasper: memory leak in jas_iccprof_createfrombuf()
https://notcve.org/view.php?id=CVE-2016-2116
Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file. Fuga de memoria en la función jas_iccprof_createfrombuf en JasPer 1.900.1 y versiones anteriores permite a atacantes remotos provocar una denegación de servicio (consumo de memoria) a través de un perfil de color ICC en un archivo de imagen JPEG2000. • http://www.debian.org/security/2016/dsa-3508 http://www.openwall.com/lists/oss-security/2016/03/03/12 http://www.securityfocus.com/bid/84133 http://www.ubuntu.com/usn/USN-2919-1 https://access.redhat.com/errata/RHSA-2017:1208 https://bugs.launchpad.net/ubuntu/+source/jasper/+bug/1547865 https://access.redhat.com/security/cve/CVE-2016-2116 https://bugzilla.redhat.com/show_bug.cgi?id=1314472 • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •