CVE-2016-9387

Published: 23 March 2017

Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure.

Priority

CVSS 3 base score: 7.8

Status

Package	Release	Status
jasper Launchpad, Ubuntu, Debian	artful	Does not exist
	bionic	Does not exist
	precise	Does not exist (precise was needs-triage)
	trusty	Does not exist (trusty was released [1.900.1-14ubuntu3.5])
	upstream	Needs triage
	xenial	Released (1.900.1-debian1-2.4ubuntu1.2)
	yakkety	Ignored (reached end-of-life)
	zesty	Does not exist
	Patches: upstream: https://github.com/mdadams/jasper/commit/d91198abd00fc435a397fe6bad906a4c1748e9cf upstream: https://github.com/mdadams/jasper/commit/a712a2041085e7cd5f2b153e1532ac2a2954ffaa

References

Bugs

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›