Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-9388: JasPer image processing can crash servers

CVE-2016-9388 · published 9 years ago

Summary

The JasPer image library used in some Ubuntu Linux installations can be forced to stop working when it receives a specially crafted image file. An attacker who can send such a file could make the affected system unavailable until it is restarted. Upgrade JasPer to version 1.900.14 or later to prevent this problem.

What to do

Update jasper_project jasper to version 1.900.14 or later.

Affected software

Vendor	Product	Affected versions
jasper_project	jasper	< 1.900.14 `cpe:2.3:a:jasper_project:jasper::::::::`
canonical	ubuntu_linux	14.04 16.04 `cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::`

Original advisory text

The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.

References

http://www.securityfocus.com/bid/94371 Broken Link Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2016/11/17/1 Mailing List Patch VDB Entry
https://access.redhat.com/errata/RHSA-2017:1208 Third Party Advisory
https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure Patch Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1396962 Issue Tracking Third Party Advisory VDB Entry
https://github.com/mdadams/jasper/commit/411a4068f8c464e883358bf403a3e2515886382... Patch Third Party Advisory
https://usn.ubuntu.com/3693-1/ Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-617Reachable Assertion

Timeline

Published23 Mar 2017

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2016-9388 · NVD

Track software like this

Free during beta