Vulnerability Details CVE-2016-8690
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 35.2%
CVSS Severity
CVSS v3 Score 5.5
CVSS v2 Score 4.3
References
- http://www.openwall.com/lists/oss-security/2016/08/23/6
- http://www.openwall.com/lists/oss-security/2016/10/16/14
- http://www.securityfocus.com/bid/93590
- https://access.redhat.com/errata/RHSA-2017:1208
- https://blogs.gentoo.org/ago/2016/10/16/jasper-two-null-pointer-dereference-in-bmp_getdata-bmp_dec-c/
- https://bugzilla.redhat.com/show_bug.cgi?id=1385499
- https://github.com/mdadams/jasper/commit/8f62b4761711d036fd8964df256b938c809b7fca
- https://lists.debian.org/debian-lts-announce/2018/11/msg00023.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22FCKKHQCQ3S6TZY5G44EFDTMWOJXJRD/
- http://www.openwall.com/lists/oss-security/2016/08/23/6
- http://www.openwall.com/lists/oss-security/2016/10/16/14
- http://www.securityfocus.com/bid/93590
- https://access.redhat.com/errata/RHSA-2017:1208
- https://blogs.gentoo.org/ago/2016/10/16/jasper-two-null-pointer-dereference-in-bmp_getdata-bmp_dec-c/
- https://bugzilla.redhat.com/show_bug.cgi?id=1385499
- https://github.com/mdadams/jasper/commit/8f62b4761711d036fd8964df256b938c809b7fca
- https://lists.debian.org/debian-lts-announce/2018/11/msg00023.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22FCKKHQCQ3S6TZY5G44EFDTMWOJXJRD/
Products affected by CVE-2016-8690
-
cpe:2.3:a:jasper_project:jasper:-
-
cpe:2.3:a:jasper_project:jasper:1.900.1
-
cpe:2.3:a:jasper_project:jasper:1.900.10
-
cpe:2.3:a:jasper_project:jasper:1.900.11
-
cpe:2.3:a:jasper_project:jasper:1.900.12
-
cpe:2.3:a:jasper_project:jasper:1.900.13
-
cpe:2.3:a:jasper_project:jasper:1.900.14
-
cpe:2.3:a:jasper_project:jasper:1.900.15
-
cpe:2.3:a:jasper_project:jasper:1.900.16
-
cpe:2.3:a:jasper_project:jasper:1.900.17
-
cpe:2.3:a:jasper_project:jasper:1.900.18
-
cpe:2.3:a:jasper_project:jasper:1.900.19
-
cpe:2.3:a:jasper_project:jasper:1.900.2
-
cpe:2.3:a:jasper_project:jasper:1.900.20
-
cpe:2.3:a:jasper_project:jasper:1.900.21
-
cpe:2.3:a:jasper_project:jasper:1.900.22
-
cpe:2.3:a:jasper_project:jasper:1.900.23
-
cpe:2.3:a:jasper_project:jasper:1.900.24
-
cpe:2.3:a:jasper_project:jasper:1.900.25
-
cpe:2.3:a:jasper_project:jasper:1.900.26
-
cpe:2.3:a:jasper_project:jasper:1.900.27
-
cpe:2.3:a:jasper_project:jasper:1.900.28
-
cpe:2.3:a:jasper_project:jasper:1.900.29
-
cpe:2.3:a:jasper_project:jasper:1.900.3
-
cpe:2.3:a:jasper_project:jasper:1.900.4
-
cpe:2.3:a:jasper_project:jasper:1.900.5
-
cpe:2.3:a:jasper_project:jasper:1.900.6
-
cpe:2.3:a:jasper_project:jasper:1.900.7
-
cpe:2.3:a:jasper_project:jasper:1.900.8
-
cpe:2.3:a:jasper_project:jasper:1.900.9
-
cpe:2.3:o:fedoraproject:fedora:23