JasPer vulnerabilities

There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of Jasper 2.0.13, which may lead to a remote denial of service attack.

There is a reachable assertion abort in the function jpc_dequantize() in JasPer 2.0.12 that can lead to a remote denial of service attack.

There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that can lead to a remote denial of service attack.

There is a reachable assertion abort in the function jpc_dec_process_siz() in JasPer 2.0.12 that may lead to a remote denial of service attack.

There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack.

There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote denial of service attack.

There is a reachable assertion abort in the function jpc_floorlog2() in JasPer 2.0.12 that can lead to a remote denial of service attack.

There is a reachable assertion abort in the function jpc_dec_process_siz() in JasPer 2.0.12 that can lead to a remote denial of service attack.

There is a reachable assertion abort in the function jpc_dec_process_sot() in JasPer 2.0.12 that can lead to a remote denial of service attack due to an unexpected jpc_ppmstabtostreams return value.

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.

The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.

The jpc_floorlog2 function in jpc_math.c in JasPer before version 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.

The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.

The JPC_NOMINALGAIN function in JasPer through version 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors.

The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer.

The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before version 1.900.14 allow remote attackers to cause a denial of service (assertion failure).

Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure.

Heap-based buffer overflow in the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer 2.0.10 allows remote attackers to exploit it via a crafted image.

Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.

The jp2_colr_destroy function in JasPer before version 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leveraging incorrect cleanup of JP2 box data on error. This vulnerability exists because of an incomplete fix for CVE-2016-8887.

Heap-based buffer overflow in the jpc_dec_tiledecode function in JasPer before version 1.900.12 can be exploited by remote attackers via a crafted image file.

The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before version 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.

A stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before version 1.900.30 allows remote attackers to exploit it via a crafted image.

A double free vulnerability in the mem_close function in jas_stream.c in JasPer before version 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.