CVE-2016-9391
HighSummary
The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer.
Risk Assessment
An attacker can exploit this vulnerability to disrupt service availability, potentially leading to downtime and loss of service.
Recommendation
It is recommended to update JasPer to version 2.0.10 or later to mitigate this vulnerability.
Other vulnerabilities in JasPer
See all- CVE-2017-14229High
There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of Jasper 2.0.13, which may lead to a remote denial of service attack.
- CVE-2017-13752High
There is a reachable assertion abort in the function jpc_dequantize() in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-13751High
There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-13750High
There is a reachable assertion abort in the function jpc_dec_process_siz() in JasPer 2.0.12 that may lead to a remote denial of service attack.
- CVE-2017-13749High
There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
- CVE-2017-13748High
There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote denial of service attack.
- CVE-2017-13747High
There is a reachable assertion abort in the function jpc_floorlog2() in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-13746High
There is a reachable assertion abort in the function jpc_dec_process_siz() in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-13745High
There is a reachable assertion abort in the function jpc_dec_process_sot() in JasPer 2.0.12 that can lead to a remote denial of service attack due to an unexpected jpc_ppmstabtostreams return value.
- CVE-2017-1000050High
JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.
Original NVD description (English source)
The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer.