Skip to content
OpenAdvisories
Unscored USN-3693-1 18 CVEs

jasper vulnerabilities

Published Jun 27, 2018 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that JasPer incorrectly handled certain malformed
JPEG-2000 image files. If a user or automated system using JasPer were
tricked into opening a specially crafted image, an attacker could exploit
this to cause a denial of service or possibly execute code with the
privileges of the user invoking the program.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS jasper 1.900.1-14ubuntu3.5
Ubuntu · 16.04 LTS 16.04:LTS jasper 1.900.1-debian1-2.4ubuntu1.2

Vulnerabilities 18

  • Unscored —
    CVE-2015-5203

    Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a …

    jasper Ubuntu
  • Unscored —
    CVE-2015-5221

    Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 librar…

    jasper Ubuntu
  • Unscored —
    CVE-2016-10248

    The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of se…

    jasper Ubuntu
  • Unscored —
    CVE-2016-10250

    The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of servi…

    jasper Ubuntu
  • Unscored —
    CVE-2016-8883

    The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of serv…

    jasper Ubuntu
  • Unscored —
    CVE-2016-8887

    The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a d…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9387

    Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9388

    The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (a…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9389

    The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of …

    jasper Ubuntu
  • Unscored —
    CVE-2016-9390

    The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of servi…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9391

    The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of ser…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9392

    The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service …

    jasper Ubuntu
  • Unscored —
    CVE-2016-9393

    The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of serv…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9394

    The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of servi…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9396

    The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of s…

    jasper Ubuntu
  • Unscored —
    CVE-2016-9600

    JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000…

    JasPer jasper jasper Ubuntu
  • Unscored —
    CVE-2017-1000050

    JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the …

    jasper jasper Ubuntu Alpine
  • Unscored —
    CVE-2017-6850

    The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service…

    jasper Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2015-5203
  • report
    https://ubuntu.com/security/CVE-2015-5221
  • report
    https://ubuntu.com/security/CVE-2016-8883
  • report
    https://ubuntu.com/security/CVE-2016-8887
  • report
    https://ubuntu.com/security/CVE-2016-9262
  • report
    https://ubuntu.com/security/CVE-2016-9387
  • report
    https://ubuntu.com/security/CVE-2016-9388
  • report
    https://ubuntu.com/security/CVE-2016-9389
  • report
    https://ubuntu.com/security/CVE-2016-9390
  • report
    https://ubuntu.com/security/CVE-2016-9391
  • report
    https://ubuntu.com/security/CVE-2016-9392
  • report
    https://ubuntu.com/security/CVE-2016-9393
  • report
    https://ubuntu.com/security/CVE-2016-9394
  • report
    https://ubuntu.com/security/CVE-2016-9396
  • report
    https://ubuntu.com/security/CVE-2016-9600
  • report
    https://ubuntu.com/security/CVE-2016-10248
  • report
    https://ubuntu.com/security/CVE-2016-10250
  • report
    https://ubuntu.com/security/CVE-2017-6850
  • report
    https://ubuntu.com/security/CVE-2017-1000050