PT-2008-4912 · Jasper+1 · Jasper+1

Michael D. Adams · Publicado 2008-10-02 · Atualizado 2023-02-13 · CVE-2008-3521

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions JasPer version 1.900.1

Description A race condition exists in the jas stream tmpfile function, allowing local users to cause a denial of service by creating a specific temporary file, which causes the program to exit.

Recommendations For JasPer version 1.900.1, consider restricting access to the jas stream tmpfile function as a temporary workaround until a patch is available.

Exploit

Correção

DoS

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

ALT-PU-2016-2474

CVE-2008-3521

Produtos afetados

Alt Linux

Jasper

Referências · 67

• 🔥 http://bugs.gentoo.org/attachment.cgi?id=163282&action=view · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2116 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3521 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-06438 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2008-3521 · Nota
• https://blogs.gentoo.org/ago/2016/10/23/jasper-heap-based-buffer-overflow-in-jpc_dec_tiledecode-jpc_dec-c · Nota
• https://bdu.fstec.ru/vul/2015-08362 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8693 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8885 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-08357 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-06433 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-06432 · Nota de Segurança
• https://blogs.gentoo.org/ago/2016/10/16/jasper-two-divide-by-zero-in-jpc_dec_process_siz-jpc_dec-c · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2089 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8158 · Nota de Segurança