Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
CVSS Details
- CVSS 3.0 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux | — | Upgrade jasper | Jun 7, 2017 | Nov 5, 2016 |
| Centos_linux | — | Upgrade jasper-debuginfoUpgrade jasper-libsUpgrade jasper-develUpgrade jasper-utilsUpgrade jasper | May 19, 2017 | Nov 5, 2016 |
| Debian | — | Upgrade jasper | Feb 20, 2019 | Jul 25, 2017 |
| Freebsd | — | Upgrade jasper | Dec 10, 2025 | Aug 18, 2015 |
| Huawei Euleros 2_0_sp1 | — | Upgrade jasper-libs | Jan 18, 2018 | Jul 25, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade jasper-libs | Jan 18, 2018 | Jul 25, 2017 |
| Oracle_linux | — | Upgrade jasper-libsUpgrade jasper-develUpgrade jasperUpgrade jasper-utils | May 9, 2017 | Aug 20, 2015 |
| Redhat_linux | — | Upgrade jasper-develUpgrade jasperUpgrade jasper-utilsUpgrade jasper-debuginfoUpgrade jasper-libs | May 9, 2017 | Nov 5, 2016 |
| Suse | — | Upgrade libjasper-x86Upgrade libjasperUpgrade libjasper4Upgrade libjasper-32bitUpgrade libjasper1Upgrade libjasper-develUpgrade libjasper1-32bit | Nov 5, 2016 | Nov 5, 2016 |
| Ubuntu | — | Upgrade libjasper1 | Jul 3, 2018 | Nov 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub