CVE-2016-9262

Published: 23 March 2017

Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities.

Priority

CVSS 3 base score: 5.5

Status

Package	Release	Status
jasper Launchpad, Ubuntu, Debian	precise	Does not exist (precise was needs-triage)
	trusty	Does not exist (trusty was not-affected)
	upstream	Needs triage
	xenial	Not vulnerable
	yakkety	Not vulnerable
	zesty	Does not exist