Skip to content
OpenAdvisories
High RHSA-2017:1208 30 CVEs

Red Hat Security Advisory: jasper security update

Published Sep 16, 2024 · Updated Jul 1, 2026

Ecosystem: Red Hat

Fixed packages 40

ReleasePackageFixed in
Red Hat · RHEL 6 enterprise_linux:6::client jasper 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client jasper-debuginfo 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client jasper-devel 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client jasper-libs 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client jasper-utils 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode jasper 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode jasper-debuginfo 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode jasper-devel 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode jasper-libs 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode jasper-utils 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server jasper 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server jasper-debuginfo 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server jasper-devel 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server jasper-libs 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server jasper-utils 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation jasper 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation jasper-debuginfo 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation jasper-devel 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation jasper-libs 0:1.900.1-21.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation jasper-utils 0:1.900.1-21.el6_9
Red Hat · RHEL 7 enterprise_linux:7::client jasper 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client jasper-debuginfo 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client jasper-devel 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client jasper-libs 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::client jasper-utils 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode jasper 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode jasper-debuginfo 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode jasper-devel 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode jasper-libs 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::computenode jasper-utils 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server jasper 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server jasper-debuginfo 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server jasper-devel 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server jasper-libs 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::server jasper-utils 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation jasper 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation jasper-debuginfo 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation jasper-devel 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation jasper-libs 0:1.900.1-30.el7_3
Red Hat · RHEL 7 enterprise_linux:7::workstation jasper-utils 0:1.900.1-30.el7_3

Vulnerabilities 30

  • High 7.8
    CVE-2016-8654

    A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too smal…

    The Jasper Project jasper jasper Ubuntu
  • Medium 5.5
    CVE-2016-9583

    An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when proces…

    The Jasper Project jasper
  • Unscored —
    CVE-2015-5203

    Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a …

    jasper Ubuntu
  • Unscored —
    CVE-2015-5221

    Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 librar…

    jasper Ubuntu
  • Unscored —
    CVE-2016-10248

    The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of se…

    jasper Ubuntu
  • Unscored —
    CVE-2016-10249

    Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to h…

    jasper Ubuntu
  • Unscored —
    CVE-2016-10251

    Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to ha…

    jasper Ubuntu
  • Unscored —
    CVE-2016-1577

    Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers …

    jasper Ubuntu
  • Unscored —
    CVE-2016-1867

    The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out-of-bounds read…

    jasper Ubuntu
  • Unscored —
    CVE-2016-2089

    The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (inval…

    jasper Ubuntu
  • Unscored —
    CVE-2016-2116

    Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a …

    jasper Ubuntu
  • Unscored —
    CVE-2016-8690

    The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial …

    jasper Ubuntu
  • Unscored —
    CVE-2016-8691

    The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a…

    jasper Ubuntu
  • Unscored —
    CVE-2016-8692

    The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a…

    jasper Ubuntu
  • Unscored —
    CVE-2016-8693

    Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers t…

    jasper Ubuntu
  • Unscored —
    CVE-2016-8883

    The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of serv…

    jasper Ubuntu
  • Unscored —
    CVE-2016-8884

    The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of serv…

    jasper Ubuntu
  • Unscored —
    CVE-2016-8885

    The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial …

    jasper Ubuntu
  • Unscored —
    CVE-2016-9262

    Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas…

  • Unscored —
    CVE-2016-9387

    Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9388

    The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (a…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9389

    The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of …

    jasper Ubuntu
  • Unscored —
    CVE-2016-9390

    The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of servi…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9391

    The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of ser…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9392

    The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service …

    jasper Ubuntu
  • Unscored —
    CVE-2016-9393

    The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of serv…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9394

    The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of servi…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9560

    Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote at…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9591

    JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resu…

    JasPer jasper jasper Ubuntu
  • Unscored —
    CVE-2016-9600

    JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000…

    JasPer jasper jasper Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1254242
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1255710
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1298135
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1302636
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1314466
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1314472
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1385499
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1385502
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1385507
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1388840
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1388870
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1393882
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1396959
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1396962
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1396963
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1396965
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1396967
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1396971
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1398256
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1399167
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1405148
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1406405
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1410026
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1434447
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1434461
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1208.json
  • report
    https://access.redhat.com/security/cve/CVE-2015-5203
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5203
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5203
  • report
    https://access.redhat.com/security/cve/CVE-2015-5221
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2015-5221
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2015-5221
  • report
    https://access.redhat.com/security/cve/CVE-2016-1577
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1577
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1577
  • report
    https://access.redhat.com/security/cve/CVE-2016-1867
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-1867
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-1867