PT-2017-7829 · Jasper+2 · Jasper+2

Agostino Sarubbo · Publicado 2016-12-21 · Atualizado 2018-06-29 · CVE-2016-10250

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions JasPer versions prior to 1.900.13

Description The issue allows remote attackers to cause a denial of service by leveraging incorrect cleanup of JP2 box data on error, specifically through the jp2 colr destroy function in jp2 cod.c. This is due to an incomplete fix for a previous issue.

Recommendations For versions prior to 1.900.13, update to version 1.900.13 or later to resolve the issue.

Exploit

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2016-2474

CVE-2016-10250

MGASA-2017-0474

USN-3693-1

Produtos afetados

Alt Linux

Jasper

Ubuntu

Referências · 39

• 🔥 https://blogs.gentoo.org/ago/2016/10/23/jasper-null-pointer-dereference-in-jp2_colr_destroy-jp2_cod-c-incomplete-fix-for-cve-2016-8887 · Exploit
• https://github.com/mdadams/jasper/commit/bdfe95a6e81ffb4b2fad31a76b57943695beed20 · Correção
• https://github.com/mdadams/jasper/releases · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/THLEZURI4D24PRM7SMASC5I25IAWXXTM · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-9390 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-9387 · Aviso do Fabricante
• http://seclists.org/oss-sec/2017/q1/608 · Nota
• https://ubuntu.com/security/CVE-2016-9391 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-10248 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-10250 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-9396 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-9394 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-1000050 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-10250 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-9600 · Aviso do Fabricante