CVE-2017-13745 - There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPe

CVE-2017-13745

Summary

There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack by triggering an unexpected jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154.

References

Vulnerable Configurations

cpe:2.3:a:jasper_project:jasper:2.0.12:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:2.0.12:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 03-02-2021 - 04:15)
Impact:
Exploitability:

CWE

CWE-617

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:P

refmap via4

bid	100514
confirm	https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
gentoo	GLSA-201908-03
misc	https://bugzilla.redhat.com/show_bug.cgi?id=1485274 https://www.oracle.com/security-alerts/cpuapr2020.html

Last major update

03-02-2021 - 04:15

Published

29-08-2017 - 06:29

Last modified

03-02-2021 - 04:15