Vulnerabilities > Jasper Project

DATE CVE VULNERABILITY TITLE RISK
2017-02-15 CVE-2016-8690 NULL Pointer Dereference vulnerability in multiple products
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.
local
low complexity
jasper-project fedoraproject CWE-476
5.5
2017-01-13 CVE-2016-8883 Resource Management Errors vulnerability in Jasper Project Jasper
The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
4.3
2017-01-13 CVE-2016-8882 NULL Pointer Dereference vulnerability in Jasper Project Jasper
The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
4.3
2016-04-13 CVE-2016-2116 Resource Management Errors vulnerability in multiple products
Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file.
4.3
2016-04-13 CVE-2016-1577 Denial of Service vulnerability in JasPer
Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137.
6.8
2016-02-08 CVE-2016-2089 Improper Input Validation vulnerability in Jasper Project Jasper 1.900.1
The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image.
4.3
2016-01-20 CVE-2016-1867 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Jasper Project Jasper 1.900.1
The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image.
4.3
2015-01-26 CVE-2014-8158 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.
6.8
2015-01-26 CVE-2014-8157 Numeric Errors vulnerability in multiple products
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.
network
low complexity
opensuse debian redhat jasper-project CWE-189
7.5
2014-12-24 CVE-2014-8138 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file.
network
low complexity
redhat jasper-project CWE-119
7.5