CVE-2016-8693
HighSummary
A double free vulnerability in the mem_close function in jas_stream.c in JasPer before version 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
Risk Assessment
Organizations may be exposed to attacks that lead to system crashes or unauthorized code execution, potentially resulting in data loss or security breaches.
Recommendation
It is recommended to update JasPer to version 1.900.10 or later to mitigate this vulnerability and to monitor systems for suspicious activity related to BMP image processing.
Other vulnerabilities in JasPer
See all- CVE-2017-14229High
There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of Jasper 2.0.13, which may lead to a remote denial of service attack.
- CVE-2017-13752High
There is a reachable assertion abort in the function jpc_dequantize() in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-13751High
There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-13750High
There is a reachable assertion abort in the function jpc_dec_process_siz() in JasPer 2.0.12 that may lead to a remote denial of service attack.
- CVE-2017-13749High
There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
- CVE-2017-13748High
There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote denial of service attack.
- CVE-2017-13747High
There is a reachable assertion abort in the function jpc_floorlog2() in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-13746High
There is a reachable assertion abort in the function jpc_dec_process_siz() in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-13745High
There is a reachable assertion abort in the function jpc_dec_process_sot() in JasPer 2.0.12 that can lead to a remote denial of service attack due to an unexpected jpc_ppmstabtostreams return value.
- CVE-2017-1000050High
JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.
Original NVD description (English source)
Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.