Skip to content
OpenAdvisories
High USN-3295-1 11 CVEs

jasper vulnerabilities

Published May 18, 2017 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that JasPer incorrectly handled certain malformed
JPEG-2000 image files. If a user or automated system using JasPer were
tricked into opening a specially crafted image, an attacker could exploit
this to cause a denial of service or possibly execute code with the
privileges of the user invoking the program.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS jasper 1.900.1-14ubuntu3.4
Ubuntu · 16.04 LTS 16.04:LTS jasper 1.900.1-debian1-2.4ubuntu1.1

Vulnerabilities 11

  • High 7.8
    CVE-2016-8654

    A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too smal…

    The Jasper Project jasper jasper Ubuntu
  • Unscored —
    CVE-2016-10249

    Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to h…

    jasper Ubuntu
  • Unscored —
    CVE-2016-10251

    Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to ha…

    jasper Ubuntu
  • Unscored —
    CVE-2016-1867

    The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out-of-bounds read…

    jasper Ubuntu
  • Unscored —
    CVE-2016-2089

    The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (inval…

    jasper Ubuntu
  • Unscored —
    CVE-2016-8691

    The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a…

    jasper Ubuntu
  • Unscored —
    CVE-2016-8692

    The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a…

    jasper Ubuntu
  • Unscored —
    CVE-2016-8693

    Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers t…

    jasper Ubuntu
  • Unscored —
    CVE-2016-8882

    The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a de…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9560

    Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote at…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9591

    JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resu…

    JasPer jasper jasper Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2016-1867
  • report
    https://ubuntu.com/security/CVE-2016-2089
  • report
    https://ubuntu.com/security/CVE-2016-8654
  • report
    https://ubuntu.com/security/CVE-2016-8691
  • report
    https://ubuntu.com/security/CVE-2016-8692
  • report
    https://ubuntu.com/security/CVE-2016-8693
  • report
    https://ubuntu.com/security/CVE-2016-8882
  • report
    https://ubuntu.com/security/CVE-2016-9560
  • report
    https://ubuntu.com/security/CVE-2016-9591
  • report
    https://ubuntu.com/security/CVE-2016-10249
  • report
    https://ubuntu.com/security/CVE-2016-10251