Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally reported as a symlink issue, but this was incorrect. NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion.
CVSS Details
- CVSS 3.1 Base Score: 4.7
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Huawei Euleros 2_0_sp5 | — | Upgrade jasper-libs | Nov 19, 2019 | Oct 2, 2008 |
| Suse | — | Upgrade libjasperUpgrade suse-releaseUpgrade libjasper-develUpgrade libjasper-32bitUpgrade libjasper-x86Upgrade jasperUpgrade libjasper-64bit | Dec 12, 2013 | Oct 2, 2008 |
| Ubuntu | — | Upgrade libjasper1Upgrade libjasper-1.701-1 | Nov 8, 2024 | Oct 2, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub