CVSS: 7.0EPSS: 0%CPEs: 10EXPL: 1CVE-2016-9591 – jasper: use-after-free / double-free in JPC encoder
https://notcve.org/view.php?id=CVE-2016-9591
JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer. JasPer, en versiones anteriores a la 2.0.12, es vulnerable a un uso de memoria previamente liberada en la forma en la que descifra ciertos archivos de imagen JPEG 2000. Esto resulta en un cierre inesperado de la aplicación que esté usando JasPer. A use-after-free flaw was found in the way JasPer, before version 2.0.12, decode certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. • http://www.securityfocus.com/bid/94952 https://access.redhat.com/errata/RHSA-2017:1208 https://bugzilla.redhat.com/show_bug.cgi?id=1406405 https://security.gentoo.org/glsa/201707-07 https://www.debian.org/security/2017/dsa-3827 https://access.redhat.com/security/cve/CVE-2016-9591 • CWE-416: Use After Free •
CVSS: 7.0EPSS: 0%CPEs: 3EXPL: 0CVE-2016-8884 – jasper: missing jas_matrix_create() parameter checks
https://notcve.org/view.php?id=CVE-2016-8884
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690. La función bmp_getdata en libjasper/bmp/bmp_dec.c en JasPer 1.900.5 permite a atacantes remotos provocar una denegación de servicio (referencia a puntero NULL) llamando al comando imginfo con una imagen BMP manipulada. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2016-8690. • http://www.openwall.com/lists/oss-security/2016/10/23/1 http://www.openwall.com/lists/oss-security/2016/10/23/9 http://www.securityfocus.com/bid/93834 https://access.redhat.com/errata/RHSA-2017:1208 https://blogs.gentoo.org/ago/2016/10/18/jasper-two-null-pointer-dereference-in-bmp_getdata-bmp_dec-c-incomplete-fix-for-cve-2016-8690 https://bugzilla.redhat.com/show_bug.cgi?id=1385499 https://github.com/mdadams/jasper/commit/5d66894d2313e3f3469f19066e149e08ff076698 https://lists&# • CWE-20: Improper Input Validation CWE-476: NULL Pointer Dereference •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2016-9389 – jasper: reachable assertions caused by insufficient component domains checks in ICT/RCT in JPC codec
https://notcve.org/view.php?id=CVE-2016-9389
The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure). Las funciones jpc_irct y jpc_iict en jpc_mct.c en JasPer en versiones anteriores a 1.900.14 permiten a atacantes remotos provocar una denegación de servicio (fallo de aserción). • http://www.openwall.com/lists/oss-security/2016/11/17/1 http://www.securityfocus.com/bid/94371 https://access.redhat.com/errata/RHSA-2017:1208 https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure https://bugzilla.redhat.com/show_bug.cgi?id=1396963 https://github.com/mdadams/jasper/commit/dee11ec440d7908d1daf69f40a3324b27cf213ba https://usn.ubuntu.com/3693-1 https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html https://access.redhat.com/security& • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 0CVE-2016-9396 – jasper: reachable assertion in JPC_NOMINALGAIN()
https://notcve.org/view.php?id=CVE-2016-9396
The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors. La función JPC_NOMINALGAIN en jpc/jpc_t1cod.c en JasPer en la versión 2.0.12 permite a los atacantes remotos causar una denegación de servicio (fallo de aserción JPC_COX_RFT) mediante vectores no especificados. • http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html http://www.openwall.com/lists/oss-security/2016/11/17/1 http://www.securityfocus.com/bid/94379 https://access.redhat.com/errata/RHSA-2018:3253 https://access.redhat.com/errata/RHSA-2018:3505 https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure https://bugzilla.redhat.com/show_bug.cgi?id=1396978 https://bugzilla.redhat.com/show_bug.cgi?id=1485272 https://lists.fedoraproject.org/ • CWE-617: Reachable Assertion •
CVSS: 7.5EPSS: 1%CPEs: 3EXPL: 0CVE-2016-9397
https://notcve.org/view.php?id=CVE-2016-9397
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors. La función jpc_dequantize en jpc_dec.c en JasPer 1.900.13 permite a atacantes remotos provocar una denegación de servicio (fallo de aserción) a través de vectores no especificados. • http://www.openwall.com/lists/oss-security/2016/11/17/1 http://www.securityfocus.com/bid/94373 https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure https://bugzilla.redhat.com/show_bug.cgi?id=1396979 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPOVZTSIQPW2H4AFLMI3LHJEZGBVEQET • CWE-617: Reachable Assertion •