Vulnerability-Lookup

usn-3693-1

Vulnerability from osv_ubuntu

Published

2018-06-27 17:20

Modified

2026-04-22 07:36

Summary

jasper vulnerabilities

Details

It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or automated system using JasPer were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.

References

URL

Type

	https://ubuntu.com/security/notices/USN-3693-1	ADVISORY
	https://ubuntu.com/security/CVE-2015-5203	REPORT
	https://ubuntu.com/security/CVE-2015-5221	REPORT
	https://ubuntu.com/security/CVE-2016-8883	REPORT
	https://ubuntu.com/security/CVE-2016-8887	REPORT
	https://ubuntu.com/security/CVE-2016-9262	REPORT
	https://ubuntu.com/security/CVE-2016-9387	REPORT
	https://ubuntu.com/security/CVE-2016-9388	REPORT
	https://ubuntu.com/security/CVE-2016-9389	REPORT
	https://ubuntu.com/security/CVE-2016-9390	REPORT
	https://ubuntu.com/security/CVE-2016-9391	REPORT
	https://ubuntu.com/security/CVE-2016-9392	REPORT
	https://ubuntu.com/security/CVE-2016-9393	REPORT
	https://ubuntu.com/security/CVE-2016-9394	REPORT
	https://ubuntu.com/security/CVE-2016-9396	REPORT
	https://ubuntu.com/security/CVE-2016-9600	REPORT
	https://ubuntu.com/security/CVE-2016-10248	REPORT
	https://ubuntu.com/security/CVE-2016-10250	REPORT
	https://ubuntu.com/security/CVE-2017-6850	REPORT
	https://ubuntu.com/security/CVE-2017-1000050	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2015-5203",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2015-5221",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-8883",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-8887",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9387",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9388",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9389",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9390",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9391",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9392",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9393",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9394",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9396",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9600",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-10248",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-10250",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-6850",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-1000050",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-14ubuntu3.5"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-14ubuntu3.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-14ubuntu3.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-14ubuntu3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-14",
        "1.900.1-14ubuntu3",
        "1.900.1-14ubuntu3.1",
        "1.900.1-14ubuntu3.2",
        "1.900.1-14ubuntu3.3",
        "1.900.1-14ubuntu3.4"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2015-5203",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2015-5221",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-8883",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-8887",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9387",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9388",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9389",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9390",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9391",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9392",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9393",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9394",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9396",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9600",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-10248",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-10250",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-6850",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "negligible",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2017-1000050",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-debian1-2.4ubuntu1.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-debian1-2.4ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-debian1-2.4",
        "1.900.1-debian1-2.4ubuntu1",
        "1.900.1-debian1-2.4ubuntu1.1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that JasPer incorrectly handled certain malformed\nJPEG-2000 image files. If a user or automated system using JasPer were\ntricked into opening a specially crafted image, an attacker could exploit\nthis to cause a denial of service or possibly execute code with the\nprivileges of the user invoking the program.\n",
  "id": "USN-3693-1",
  "modified": "2026-04-22T07:36:35Z",
  "published": "2018-06-27T17:20:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3693-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-5203"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-5221"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-8883"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-8887"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9262"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9387"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9388"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9389"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9390"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9391"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9392"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9393"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9394"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9396"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9600"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10248"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10250"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-6850"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-1000050"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "jasper vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2015-5203",
    "UBUNTU-CVE-2015-5221",
    "UBUNTU-CVE-2016-8883",
    "UBUNTU-CVE-2016-8887",
    "UBUNTU-CVE-2016-9262",
    "UBUNTU-CVE-2016-9387",
    "UBUNTU-CVE-2016-9388",
    "UBUNTU-CVE-2016-9389",
    "UBUNTU-CVE-2016-9390",
    "UBUNTU-CVE-2016-9391",
    "UBUNTU-CVE-2016-9392",
    "UBUNTU-CVE-2016-9393",
    "UBUNTU-CVE-2016-9394",
    "UBUNTU-CVE-2016-9396",
    "UBUNTU-CVE-2016-9600",
    "UBUNTU-CVE-2016-10248",
    "UBUNTU-CVE-2016-10250",
    "UBUNTU-CVE-2017-6850",
    "UBUNTU-CVE-2017-1000050"
  ]
}

ubuntu-cve-2015-5203

Vulnerability from osv_ubuntu

Published

2017-08-02 00:00

Modified

2026-04-22 07:37

Summary

Details

Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2015-5203	REPORT
	http://seclists.org/oss-sec/2015/q3/366	REPORT
	https://ubuntu.com/security/notices/USN-3693-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2015-5203	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-14ubuntu3.5"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-14ubuntu3.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-14ubuntu3.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-14ubuntu3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-14",
        "1.900.1-14ubuntu3",
        "1.900.1-14ubuntu3.1",
        "1.900.1-14ubuntu3.2",
        "1.900.1-14ubuntu3.3",
        "1.900.1-14ubuntu3.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-debian1-2.4ubuntu1.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-debian1-2.4ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-debian1-2.4",
        "1.900.1-debian1-2.4ubuntu1",
        "1.900.1-debian1-2.4ubuntu1.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.",
  "id": "UBUNTU-CVE-2015-5203",
  "modified": "2026-04-22T07:37:48Z",
  "published": "2017-08-02T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-5203"
    },
    {
      "type": "REPORT",
      "url": "http://seclists.org/oss-sec/2015/q3/366"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3693-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5203"
    }
  ],
  "related": [
    "USN-3693-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2015-5203"
  ]
}

ubuntu-cve-2015-5221

Vulnerability from osv_ubuntu

Published

2017-07-25 00:00

Modified

2026-04-22 07:37

Summary

Details

Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2015-5221	REPORT
	http://www.openwall.com/lists/oss-security/2015/08/20/4	REPORT
	https://ubuntu.com/security/notices/USN-3693-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2015-5221	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-14ubuntu3.5"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-14ubuntu3.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-14ubuntu3.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-14ubuntu3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-14",
        "1.900.1-14ubuntu3",
        "1.900.1-14ubuntu3.1",
        "1.900.1-14ubuntu3.2",
        "1.900.1-14ubuntu3.3",
        "1.900.1-14ubuntu3.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-debian1-2.4ubuntu1.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-debian1-2.4ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-debian1-2.4",
        "1.900.1-debian1-2.4ubuntu1",
        "1.900.1-debian1-2.4ubuntu1.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.",
  "id": "UBUNTU-CVE-2015-5221",
  "modified": "2026-04-22T07:37:48Z",
  "published": "2017-07-25T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-5221"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2015/08/20/4"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3693-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-5221"
    }
  ],
  "related": [
    "USN-3693-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2015-5221"
  ]
}

ubuntu-cve-2016-10248

Vulnerability from osv_ubuntu

Published

2017-03-15 00:00

Modified

2026-04-22 07:38

Summary

Details

The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.

Severity

7.5 (High)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      negligible

References

URL

Type

	https://ubuntu.com/security/CVE-2016-10248	REPORT
	http://www.openwall.com/lists/oss-security/2016/10/20/5	REPORT
	https://blogs.gentoo.org/ago/2016/10/20/jasper-nu…	REPORT
	https://ubuntu.com/security/notices/USN-3693-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-10248	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-14ubuntu3.5"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-14ubuntu3.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-14ubuntu3.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-14ubuntu3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-14",
        "1.900.1-14ubuntu3",
        "1.900.1-14ubuntu3.1",
        "1.900.1-14ubuntu3.2",
        "1.900.1-14ubuntu3.3",
        "1.900.1-14ubuntu3.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-debian1-2.4ubuntu1.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-debian1-2.4ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-debian1-2.4",
        "1.900.1-debian1-2.4ubuntu1",
        "1.900.1-debian1-2.4ubuntu1.1"
      ]
    }
  ],
  "aliases": [],
  "details": "The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.",
  "id": "UBUNTU-CVE-2016-10248",
  "modified": "2026-04-22T07:38:06Z",
  "published": "2017-03-15T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10248"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2016/10/20/5"
    },
    {
      "type": "REPORT",
      "url": "https://blogs.gentoo.org/ago/2016/10/20/jasper-null-pointer-dereference-in-jpc_tsfb_synthesize-jpc_tsfb-c/"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3693-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-10248"
    }
  ],
  "related": [
    "USN-3693-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "negligible",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-10248"
  ]
}

ubuntu-cve-2016-10250

Vulnerability from osv_ubuntu

Published

2017-03-15 00:00

Modified

2026-04-22 07:38

Summary

Details

The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887.

Severity

7.5 (High)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-10250	REPORT
	https://blogs.gentoo.org/ago/2016/10/23/jasper-nu…	REPORT
	http://seclists.org/oss-sec/2017/q1/608	REPORT
	https://ubuntu.com/security/notices/USN-3693-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-10250	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-14ubuntu3.5"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-14ubuntu3.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-14ubuntu3.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-14ubuntu3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-14",
        "1.900.1-14ubuntu3",
        "1.900.1-14ubuntu3.1",
        "1.900.1-14ubuntu3.2",
        "1.900.1-14ubuntu3.3",
        "1.900.1-14ubuntu3.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-debian1-2.4ubuntu1.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-debian1-2.4ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-debian1-2.4",
        "1.900.1-debian1-2.4ubuntu1",
        "1.900.1-debian1-2.4ubuntu1.1"
      ]
    }
  ],
  "aliases": [],
  "details": "The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887.",
  "id": "UBUNTU-CVE-2016-10250",
  "modified": "2026-04-22T07:38:06Z",
  "published": "2017-03-15T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-10250"
    },
    {
      "type": "REPORT",
      "url": "https://blogs.gentoo.org/ago/2016/10/23/jasper-null-pointer-dereference-in-jp2_colr_destroy-jp2_cod-c-incomplete-fix-for-cve-2016-8887"
    },
    {
      "type": "REPORT",
      "url": "http://seclists.org/oss-sec/2017/q1/608"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3693-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-10250"
    }
  ],
  "related": [
    "USN-3693-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-10250"
  ]
}

ubuntu-cve-2016-8883

Vulnerability from osv_ubuntu

Published

2017-01-13 00:00

Modified

2026-04-22 07:38

Summary

Details

The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      negligible

References

URL

Type

	https://ubuntu.com/security/CVE-2016-8883	REPORT
	http://www.openwall.com/lists/oss-security/2016/10/23/4	REPORT
	https://ubuntu.com/security/notices/USN-3693-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-8883	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-14ubuntu3.5"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-14ubuntu3.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-14ubuntu3.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-14ubuntu3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-14",
        "1.900.1-14ubuntu3",
        "1.900.1-14ubuntu3.1",
        "1.900.1-14ubuntu3.2",
        "1.900.1-14ubuntu3.3",
        "1.900.1-14ubuntu3.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-debian1-2.4ubuntu1.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-debian1-2.4ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-debian1-2.4",
        "1.900.1-debian1-2.4ubuntu1",
        "1.900.1-debian1-2.4ubuntu1.1"
      ]
    }
  ],
  "aliases": [],
  "details": "The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.",
  "id": "UBUNTU-CVE-2016-8883",
  "modified": "2026-04-22T07:38:04Z",
  "published": "2017-01-13T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-8883"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2016/10/23/4"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3693-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-8883"
    }
  ],
  "related": [
    "USN-3693-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "negligible",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-8883"
  ]
}

ubuntu-cve-2016-8887

Vulnerability from osv_ubuntu

Published

2017-03-23 00:00

Modified

2026-04-22 07:38

Summary

Details

The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference).

Severity

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2016-8887	REPORT
	https://blogs.gentoo.org/ago/2016/10/18/jasper-nu…	REPORT
	https://blogs.gentoo.org/ago/2016/10/23/jasper-nu…	REPORT
	https://ubuntu.com/security/notices/USN-3693-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-8887	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-14ubuntu3.5"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-14ubuntu3.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-14ubuntu3.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-14ubuntu3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-14",
        "1.900.1-14ubuntu3",
        "1.900.1-14ubuntu3.1",
        "1.900.1-14ubuntu3.2",
        "1.900.1-14ubuntu3.3",
        "1.900.1-14ubuntu3.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-debian1-2.4ubuntu1.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-debian1-2.4ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-debian1-2.4",
        "1.900.1-debian1-2.4ubuntu1",
        "1.900.1-debian1-2.4ubuntu1.1"
      ]
    }
  ],
  "aliases": [],
  "details": "The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference).",
  "id": "UBUNTU-CVE-2016-8887",
  "modified": "2026-04-22T07:38:04Z",
  "published": "2017-03-23T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-8887"
    },
    {
      "type": "REPORT",
      "url": "https://blogs.gentoo.org/ago/2016/10/18/jasper-null-pointer-dereference-in-jp2_colr_destroy-jp2_cod-c"
    },
    {
      "type": "REPORT",
      "url": "https://blogs.gentoo.org/ago/2016/10/23/jasper-null-pointer-dereference-in-jp2_colr_destroy-jp2_cod-c-incomplete-fix-for-cve-2016-8887"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3693-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-8887"
    }
  ],
  "related": [
    "USN-3693-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-8887"
  ]
}

ubuntu-cve-2016-9387

Vulnerability from osv_ubuntu

Published

2017-03-23 00:00

Modified

2026-04-22 07:38

Summary

Details

Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure.

Severity

7.8 (High)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      negligible

References

URL

Type

	https://ubuntu.com/security/CVE-2016-9387	REPORT
	https://github.com/asarubbo/poc/blob/master/00003…	REPORT
	http://www.openwall.com/lists/oss-security/2016/11/17/1	REPORT
	https://ubuntu.com/security/notices/USN-3693-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-9387	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-14ubuntu3.5"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-14ubuntu3.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-14ubuntu3.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-14ubuntu3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-14",
        "1.900.1-14ubuntu3",
        "1.900.1-14ubuntu3.1",
        "1.900.1-14ubuntu3.2",
        "1.900.1-14ubuntu3.3",
        "1.900.1-14ubuntu3.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-debian1-2.4ubuntu1.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-debian1-2.4ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-debian1-2.4",
        "1.900.1-debian1-2.4ubuntu1",
        "1.900.1-debian1-2.4ubuntu1.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure.",
  "id": "UBUNTU-CVE-2016-9387",
  "modified": "2026-04-22T07:38:04Z",
  "published": "2017-03-23T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9387"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/asarubbo/poc/blob/master/00003-jasper-assert-jas_matrix_t"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2016/11/17/1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3693-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-9387"
    }
  ],
  "related": [
    "USN-3693-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "negligible",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-9387"
  ]
}

ubuntu-cve-2016-9388

Vulnerability from osv_ubuntu

Published

2017-03-23 00:00

Modified

2026-04-22 07:38

Summary

Details

The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.

Severity

5.5 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

5.5 (Medium)


                    
                      CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      negligible

References

URL

Type

	https://ubuntu.com/security/CVE-2016-9388	REPORT
	http://www.openwall.com/lists/oss-security/2016/11/17/1	REPORT
	https://github.com/asarubbo/poc/blob/master/00005…	REPORT
	https://ubuntu.com/security/notices/USN-3693-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-9388	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-14ubuntu3.5"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-14ubuntu3.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-14ubuntu3.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-14ubuntu3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-14",
        "1.900.1-14ubuntu3",
        "1.900.1-14ubuntu3.1",
        "1.900.1-14ubuntu3.2",
        "1.900.1-14ubuntu3.3",
        "1.900.1-14ubuntu3.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-debian1-2.4ubuntu1.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-debian1-2.4ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-debian1-2.4",
        "1.900.1-debian1-2.4ubuntu1",
        "1.900.1-debian1-2.4ubuntu1.1"
      ]
    }
  ],
  "aliases": [],
  "details": "The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.",
  "id": "UBUNTU-CVE-2016-9388",
  "modified": "2026-04-22T07:38:04Z",
  "published": "2017-03-23T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9388"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2016/11/17/1"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/asarubbo/poc/blob/master/00005-jasper-assert-ras_getcmap"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3693-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-9388"
    }
  ],
  "related": [
    "USN-3693-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "negligible",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-9388"
  ]
}

ubuntu-cve-2016-9389

Vulnerability from osv_ubuntu

Published

2017-03-23 00:00

Modified

2026-04-22 07:38

Summary

Details

The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure).

Severity

7.5 (High)


                    
                      CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      negligible

References

URL

Type

	https://ubuntu.com/security/CVE-2016-9389	REPORT
	https://github.com/asarubbo/poc/blob/master/00006…	REPORT
	https://github.com/asarubbo/poc/blob/master/00008…	REPORT
	http://www.openwall.com/lists/oss-security/2016/11/17/1	REPORT
	https://ubuntu.com/security/notices/USN-3693-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2016-9389	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-14ubuntu3.5"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-14ubuntu3.5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-14ubuntu3.5?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-14ubuntu3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-14",
        "1.900.1-14ubuntu3",
        "1.900.1-14ubuntu3.1",
        "1.900.1-14ubuntu3.2",
        "1.900.1-14ubuntu3.3",
        "1.900.1-14ubuntu3.4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          },
          {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jasper",
        "purl": "pkg:deb/ubuntu/jasper@1.900.1-debian1-2.4ubuntu1.2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.900.1-debian1-2.4ubuntu1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.900.1-debian1-2.4",
        "1.900.1-debian1-2.4ubuntu1",
        "1.900.1-debian1-2.4ubuntu1.1"
      ]
    }
  ],
  "aliases": [],
  "details": "The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure).",
  "id": "UBUNTU-CVE-2016-9389",
  "modified": "2026-04-22T07:38:04Z",
  "published": "2017-03-23T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9389"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/asarubbo/poc/blob/master/00006-jasper-assert-jpc_irct"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/asarubbo/poc/blob/master/00008-jasper-assert-jpc_iict"
    },
    {
      "type": "REPORT",
      "url": "http://www.openwall.com/lists/oss-security/2016/11/17/1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3693-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-9389"
    }
  ],
  "related": [
    "USN-3693-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "negligible",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2016-9389"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature