Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade jasper | Jun 7, 2017 | Nov 5, 2016 |
| Centos_linux | — | Upgrade jasper-libsUpgrade jasper-debuginfoUpgrade jasperUpgrade jasper-utilsUpgrade jasper-devel | May 19, 2017 | Nov 5, 2016 |
| Debian | — | Upgrade jasper | Feb 20, 2019 | Jul 25, 2017 |
| Freebsd | — | Upgrade jasper | Dec 10, 2025 | Aug 18, 2015 |
| Huawei Euleros 2_0_sp1 | — | Upgrade jasper-libs | Jan 18, 2018 | Jul 25, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade jasper-libs | Jan 18, 2018 | Jul 25, 2017 |
| Oracle_linux | — | Upgrade jasper-libsUpgrade jasper-develUpgrade jasperUpgrade jasper-utils | May 9, 2017 | Aug 20, 2015 |
| Redhat_linux | — | Upgrade jasper-libsUpgrade jasper-debuginfoUpgrade jasperUpgrade jasper-utilsUpgrade jasper-devel | May 9, 2017 | Nov 5, 2016 |
| Suse | — | Upgrade libjasper1-32bitUpgrade libjasper-develUpgrade libjasper1Upgrade libjasperUpgrade libjasper-x86Upgrade libjasper4Upgrade libjasper-32bit | Nov 5, 2016 | Nov 5, 2016 |
| Ubuntu | — | Upgrade libjasper1 | Jul 3, 2018 | Nov 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub