CVE-2016-9600 - JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded cr

CVE-2016-9600

Summary

JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

References

Vulnerable Configurations

cpe:2.3:a:jasper_project:jasper:-:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:-:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.1:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.1:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.2:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.2:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.3:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.3:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.4:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.4:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.5:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.5:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.6:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.6:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.7:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.7:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.8:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.8:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.9:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.9:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.10:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.10:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.11:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.11:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.12:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.12:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.13:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.13:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.14:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.14:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.15:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.15:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.16:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.16:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.17:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.17:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.18:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.18:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.19:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.19:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.20:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.20:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.21:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.21:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.22:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.22:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.23:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.23:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.24:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.24:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.25:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.25:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.26:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.26:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.27:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.27:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.28:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.28:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.29:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.29:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.30:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.30:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.31:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.31:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.0:-:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.0:-:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.2:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.3:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.4:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.5:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.5:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.6:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.7:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.7:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.8:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.8:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.9:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.9:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 09-10-2019 - 23:20)
Impact:
Exploitability:

CWE

CWE-476

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

redhat via4

advisories

bugzilla

id	1434461
title	CVE-2016-10251 jasper: integer overflow in jpc_pi_nextcprl(), leading to out-of-bounds read

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 7 is installed
oval oval:com.redhat.rhba:tst:20150364027

AND
comment jasper is earlier than 0:1.900.1-30.el7_3
oval oval:com.redhat.rhsa:tst:20171208001
comment jasper is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20111807002

AND

comment jasper-devel is earlier than 0:1.900.1-30.el7_3
oval oval:com.redhat.rhsa:tst:20171208003
comment jasper-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20111807004

AND
comment jasper-libs is earlier than 0:1.900.1-30.el7_3
oval oval:com.redhat.rhsa:tst:20171208005
comment jasper-libs is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20111807006

AND

comment jasper-utils is earlier than 0:1.900.1-30.el7_3
oval oval:com.redhat.rhsa:tst:20171208007
comment jasper-utils is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20111807008

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

AND
comment jasper is earlier than 0:1.900.1-21.el6_9
oval oval:com.redhat.rhsa:tst:20171208010
comment jasper is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20111807002

AND

comment jasper-devel is earlier than 0:1.900.1-21.el6_9
oval oval:com.redhat.rhsa:tst:20171208011
comment jasper-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20111807004

AND
comment jasper-libs is earlier than 0:1.900.1-21.el6_9
oval oval:com.redhat.rhsa:tst:20171208012
comment jasper-libs is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20111807006

AND

comment jasper-utils is earlier than 0:1.900.1-21.el6_9
oval oval:com.redhat.rhsa:tst:20171208013
comment jasper-utils is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20111807008

rhsa

id	RHSA-2017:1208
released	2017-05-09
severity	Important
title	RHSA-2017:1208: jasper security update (Important)

rpms

jasper-0:1.900.1-21.el6_9
jasper-0:1.900.1-30.el7_3
jasper-debuginfo-0:1.900.1-21.el6_9
jasper-debuginfo-0:1.900.1-30.el7_3
jasper-devel-0:1.900.1-21.el6_9
jasper-devel-0:1.900.1-30.el7_3
jasper-libs-0:1.900.1-21.el6_9
jasper-libs-0:1.900.1-30.el7_3
jasper-utils-0:1.900.1-21.el6_9
jasper-utils-0:1.900.1-30.el7_3

refmap via4

confirm	https://bugzilla.redhat.com/show_bug.cgi?id=1410026
ubuntu	USN-3693-1

Last major update

09-10-2019 - 23:20

Published

12-03-2018 - 15:29

Last modified

09-10-2019 - 23:20