CVE-2015-5203: Double Free
A double free flaw was found in the way JasPer's jasperimagestopload() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
Original report:
http://seclists.org/oss-sec/2015/q3/366
Other sources
Double free vulnerability in the jasperimagestopload function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5203?
The severity of CVE-2015-5203 is classified as a high-risk vulnerability due to the potential for application crashes.
How do I fix CVE-2015-5203?
To fix CVE-2015-5203, update the jasper package to version 1.900.22 or later where applicable.
Which versions of Jasper are affected by CVE-2015-5203?
CVE-2015-5203 affects Jasper versions prior to 1.900.22, including 1.900.17 and earlier.
What type of vulnerability is CVE-2015-5203?
CVE-2015-5203 is a double free flaw found in the jasper_image_stop_load() function.
Can CVE-2015-5203 lead to remote code execution?
CVE-2015-5203 does not lead to remote code execution but can cause application crashes when processing specially crafted JPEG 2000 files.