rpm package
suse/jasper&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1
pkg:rpm/suse/jasper&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1
Vulnerabilities (28)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2016-9583 | — | < 1.900.14-194.1 | 1.900.14-194.1 | Aug 1, 2018 | An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input. | ||
| CVE-2016-8654 | — | < 1.900.14-184.1 | 1.900.14-184.1 | Aug 1, 2018 | A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected. | ||
| CVE-2016-9600 | — | < 1.900.14-194.1 | 1.900.14-194.1 | Mar 12, 2018 | JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. | ||
| CVE-2016-9591 | — | < 1.900.14-184.1 | 1.900.14-184.1 | Mar 9, 2018 | JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer. | ||
| CVE-2015-5203 | Med | 5.5 | < 1.900.14-181.1 | 1.900.14-181.1 | Aug 2, 2017 | Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file. | |
| CVE-2015-5221 | Med | 5.5 | < 1.900.14-181.1 | 1.900.14-181.1 | Jul 25, 2017 | Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file. | |
| CVE-2016-8884 | Med | 5.5 | < 1.900.14-181.1 | 1.900.14-181.1 | Mar 28, 2017 | The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016 | |
| CVE-2016-9398 | Hig | 7.5 | < 1.900.14-184.1 | 1.900.14-184.1 | Mar 23, 2017 | The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors. | |
| CVE-2016-9395 | Med | 5.5 | < 1.900.14-184.1 | 1.900.14-184.1 | Mar 23, 2017 | The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. | |
| CVE-2016-8887 | Med | 5.5 | < 1.900.14-181.1 | 1.900.14-181.1 | Mar 23, 2017 | The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference). | |
| CVE-2016-8886 | Hig | 7.8 | < 1.900.14-181.1 | 1.900.14-181.1 | Mar 23, 2017 | The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers to have unspecified impact via a crafted file, which triggers a memory allocation failure. | |
| CVE-2016-8885 | Med | 5.5 | < 1.900.14-181.1 | 1.900.14-181.1 | Mar 23, 2017 | The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. | |
| CVE-2017-6850 | Med | 5.5 | < 1.900.14-194.1 | 1.900.14-194.1 | Mar 15, 2017 | The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image. | |
| CVE-2016-10251 | Hig | 7.8 | < 1.900.14-194.1 | 1.900.14-194.1 | Mar 15, 2017 | Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value. | |
| CVE-2017-5498 | Med | 5.5 | < 1.900.14-194.1 | 1.900.14-194.1 | Mar 1, 2017 | libjasper/include/jasper/jas_math.h in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value. | |
| CVE-2016-9560 | Hig | 7.8 | < 1.900.14-184.1 | 1.900.14-184.1 | Feb 15, 2017 | Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image. | |
| CVE-2016-8693 | Hig | 7.8 | < 1.900.14-181.1 | 1.900.14-181.1 | Feb 15, 2017 | Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command. | |
| CVE-2016-8692 | Med | 5.5 | < 1.900.14-181.1 | 1.900.14-181.1 | Feb 15, 2017 | The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command. | |
| CVE-2016-8691 | Med | 5.5 | < 1.900.14-181.1 | 1.900.14-181.1 | Feb 15, 2017 | The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command. | |
| CVE-2016-8690 | Med | 5.5 | < 1.900.14-181.1 | 1.900.14-181.1 | Feb 15, 2017 | The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command. |
- CVE-2016-9583Aug 1, 2018affected < 1.900.14-194.1fixed 1.900.14-194.1
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
- CVE-2016-8654Aug 1, 2018affected < 1.900.14-184.1fixed 1.900.14-184.1
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
- CVE-2016-9600Mar 12, 2018affected < 1.900.14-194.1fixed 1.900.14-194.1
JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
- CVE-2016-9591Mar 9, 2018affected < 1.900.14-184.1fixed 1.900.14-184.1
JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016
- affected < 1.900.14-184.1fixed 1.900.14-184.1
The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
- affected < 1.900.14-184.1fixed 1.900.14-184.1
The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereference).
- affected < 1.900.14-181.1fixed 1.900.14-181.1
The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers to have unspecified impact via a crafted file, which triggers a memory allocation failure.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image.
- affected < 1.900.14-194.1fixed 1.900.14-194.1
The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image.
- affected < 1.900.14-194.1fixed 1.900.14-194.1
Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.
- affected < 1.900.14-194.1fixed 1.900.14-194.1
libjasper/include/jasper/jas_math.h in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
- affected < 1.900.14-184.1fixed 1.900.14-184.1
Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.
Page 1 of 2