CVE-2016-1577
HighSummary
A double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file.
Risk Assessment
Organizations may be exposed to attacks that lead to system crashes or unauthorized code execution, potentially resulting in data loss or security breaches.
Recommendation
It is recommended to upgrade to the latest version of JasPer to mitigate this vulnerability and to monitor systems for suspicious activity related to JPEG 2000 files.
Other vulnerabilities in JasPer 1.900.1 i wcześniejsze
See all- CVE-2014-8138High
Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file.
- CVE-2014-9029High
Multiple off-by-one errors in the jpc_dec_cp_setfromcox and jpc_dec_cp_setfromrgn functions in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, leading to a heap-based buffer overflow.
Original NVD description (English source)
Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137.