Jasper - Use-after-free and Integer Overflow Vulnerabilities
Summary
DLA-920-1: jasper - security update. Affects jasper versions < 1.900.1-13+deb7u6. Fixed in 1.900.1-13+deb7u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jasper is an open-source software library for manipulating JPEG-2000 images. It provides functionality for encoding and decoding JPEG-2000 images, as well as various image manipulation operations. The library is widely used in applications that handle image processing and storage. However, certain versions of Jasper are vulnerable to two critical security issues.
Vulnerability Detail
The first vulnerability, identified as CVE-2016-9591, is a use-after-free vulnerability that exists in the code responsible for re-encoding decoded input image files to JP2 images. This vulnerability occurs due to the failure to set related pointers to null after they are freed, leading to a use-after-free condition and potential double-free. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
The second vulnerability, identified as CVE-2016-10251, is an integer overflow vulnerability in the jpc_pi_nextcprl function in JasPer. This vulnerability allows remote attackers to have an unspecified impact by crafting a file that triggers the use of an uninitialized value. The consequences of this vulnerability can vary depending on the specific application using the vulnerable version of Jasper.
How To Fix
Minimum fixed version
1.900.1-13+deb7u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jasperTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is crucial to apply the recommended fix by upgrading the Jasper package to the patched version.
Conclusion
Upgrading the Jasper package to version 1.900.1-13+deb7u6 or later is crucial to mitigate the use-after-free and integer overflow vulnerabilities. It is recommended to promptly apply the available patches to ensure the security and stability of systems utilizing Jasper. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jasper →
FAQ
CVE-2016-9591 can allow an attacker to execute arbitrary code or cause a denial of service by exploiting the use-after-free vulnerability in Jasper's re-encoding functionality.
CVE-2016-10251 can be exploited by crafting a malicious file that triggers the use of an uninitialized value in Jasper. The impact of this vulnerability depends on the specific application using the vulnerable version of Jasper.
No, there are no known workarounds for these vulnerabilities. It is essential to upgrade the Jasper package to the patched version.
The patched version of Jasper (1.900.1-13+deb7u6 or later) can be obtained from the official Debian repositories or through the package manager of your Debian 7 Wheezy system.
The vulnerabilities CVE-2016-9591 and CVE-2016-10251 specifically affect Jasper version 1.900.1-13+deb7u6 and earlier in Debian 7 Wheezy. Other versions or distributions may have different vulnerabilities or may not be affected.
Related vulnerabilities
Recent vulnerabilities recorded for jasper.
