Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade jasper | Jun 7, 2017 | Nov 5, 2016 |
| Centos_linux | — | Upgrade jasper-develUpgrade jasperUpgrade jasper-utilsUpgrade jasper-debuginfoUpgrade jasper-libs | May 19, 2017 | Nov 5, 2016 |
| Debian | — | Upgrade jasper | Feb 20, 2019 | Jul 25, 2017 |
| Freebsd | — | Upgrade jasper | Dec 10, 2025 | Aug 18, 2015 |
| Huawei Euleros 2_0_sp1 | — | Upgrade jasper-libs | Jan 18, 2018 | Jul 25, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade jasper-libs | Jan 18, 2018 | Jul 25, 2017 |
| Oracle_linux | — | Upgrade jasper-libsUpgrade jasper-develUpgrade jasper-utilsUpgrade jasper | May 9, 2017 | Aug 20, 2015 |
| Redhat_linux | — | Upgrade jasperUpgrade jasper-develUpgrade jasper-utilsUpgrade jasper-libsUpgrade jasper-debuginfo | May 9, 2017 | Nov 5, 2016 |
| Suse | — | Upgrade libjasper1-32bitUpgrade libjasper-develUpgrade libjasper1Upgrade libjasper4Upgrade libjasper-x86Upgrade libjasper-32bitUpgrade libjasper | Nov 5, 2016 | Nov 5, 2016 |
| Ubuntu | — | Upgrade libjasper1 | Jul 3, 2018 | Nov 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub