CVE-2016-9393

Published: 23 March 2017

The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.

Priority

CVSS 3 base score: 5.5

Status

Package	Release	Status
jasper Launchpad, Ubuntu, Debian	Upstream	Needs triage




	Ubuntu 18.04 LTS (Bionic Beaver)	Does not exist
	Ubuntu 16.04 ESM (Xenial Xerus)	Released (1.900.1-debian1-2.4ubuntu1.2)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was released [1.900.1-14ubuntu3.5])
	Patches: Upstream: https://github.com/mdadams/jasper/commit/f7038068550fba0e41e1d0c355787f1dcd5bf330

Notes

Author	Note
mdeslaur	same commit as CVE-2016-9392

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9393
https://github.com/asarubbo/poc/blob/master/00013-jasper-assert-jpc_pi_nextrpcl (testcase)
http://www.openwall.com/lists/oss-security/2016/11/17/1
https://ubuntu.com/security/notices/USN-3693-1
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›