CVE-2016-10248: Null Pointer Dereference
Last updated 24 July 2024
Other sources
Null pointer dereference vulnerability in jpctsfbsynthesize was found.
Upstream patch:
https://github.com/mdadams/jasper/commit/2e82fa00466ae525339754bb3ab0a0474a31d4bd
Published on oss-security:
http://seclists.org/oss-sec/2017/q1/606
Reference:
https://blogs.gentoo.org/ago/2016/10/20/jasper-null-pointer-dereference-in-jpctsfbsynthesize-jpctsfb-c/
— Red Hat
The jpctsfbsynthesize function in jpctsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10248?
CVE-2016-10248 is classified as a medium severity vulnerability due to its potential to cause a null pointer dereference.
How do I fix CVE-2016-10248?
To fix CVE-2016-10248, upgrade to jasper version 1.900.9 or later if you are using Red Hat, or ensure you are updated beyond version 1.900.8 if you are using other distributions.
What software is affected by CVE-2016-10248?
CVE-2016-10248 affects jasper versions up to and including 1.900.8 for multiple distributions, including Debian and Red Hat.
What is a null pointer dereference as seen in CVE-2016-10248?
A null pointer dereference in CVE-2016-10248 occurs when the software attempts to access an object or variable that hasn't been initialized, leading to potential crashes or unpredictable behavior.
Is there an upstream patch for CVE-2016-10248?
Yes, there is an upstream patch available for CVE-2016-10248 which addresses the null pointer dereference issue in the affected software.