PT-2017-10207 · Jasper+5 · Jasper+5

Agostino Sarubbo · Published 2016-12-21 · Updated 2024-06-15 · CVE-2016-9560

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JasPer versions prior to 1.900.30

Description The issue is related to a stack-based buffer overflow in the jpc tsfb getbands2 function in jpc tsfb.c. This allows remote attackers to have an unspecified impact via a crafted image.

Recommendations For versions prior to 1.900.30, update to version 1.900.30 or later to resolve the issue. As a temporary workaround, consider restricting the processing of crafted images until a patch is applied.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2016-2474

ALT-PU-2018-1947

ALT-PU-2020-2972

ALT-PU-2020-3065

CESA-2017_1208

CVE-2016-9560

DLA-739-1

DSA-3785-1

ELSA-2017-1208

MGASA-2017-0474

OPENSUSE-SU-2017_0101-1

OPENSUSE-SU-2024:10281-1

RHSA-2017:1208

RHSA-2017_1208

SUSE-SU-2017:0084-1

SUSE-SU-2017:0946-1

USN-3295-1

Affected Products

Alt Linux

Centos

Jasper

Red Hat

Suse

Ubuntu

References · 102

• 🔥 https://github.com/asarubbo/poc/blob/master/00006-jasper-assert-jpc_irct · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00043-jasper-assert-jas_matrix_t · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00003-jasper-assert-jas_matrix_t · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00008-jasper-assert-jpc_iict · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00012-jasper-assert-calcstepsizes · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00004-jasper-assert-JPC_NOMINALGAIN · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00016-jasper-assert-jas_matrix_t · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00023-jasper-assert-jpc_floorlog2 · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00010-jasper-assert-jpc_dequantize · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00013-jasper-assert-jpc_pi_nextrpcl · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00014-jasper-assert-jpc_bitstream_getbits · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00005-jasper-assert-ras_getcmap · Exploit
• 🔥 https://github.com/asarubbo/poc/blob/master/00007-jasper-assert-jas_matrix_t · Exploit
• 🔥 https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2016-9560 · Exploit
• 🔥 https://blogs.gentoo.org/ago/2016/11/20/jasper-stack-based-buffer-overflow-in-jpc_tsfb_getbands2-jpc_tsfb-c · Exploit