CVE-2016-10249: Buffer Overflow
Integer overflow in the jpcdectiledecode function in jpcdec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted image file, which triggers a heap-based buffer overflow.
Other sources
Out-of-bounds heap read was found in jpcdectiledecode in jpcdec.c.
CVE request:
http://seclists.org/oss-sec/2016/q4/219
Upstream patch:
https://github.com/mdadams/jasper/commit/988f8365f7d8ad8073b6786e433d34c553ecf568
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10249?
CVE-2016-10249 has a high severity due to its potential for causing a heap-based buffer overflow which can lead to remote code execution.
How do I fix CVE-2016-10249?
To fix CVE-2016-10249, upgrade the JasPer library to version 1.900.12 or later.
What impact does CVE-2016-10249 have?
CVE-2016-10249 allows remote attackers to exploit an integer overflow vulnerability, leading to a possible denial of service or arbitrary code execution.
Which software is affected by CVE-2016-10249?
CVE-2016-10249 affects the JasPer library, specifically versions prior to 1.900.12.
Is there a workaround for CVE-2016-10249?
There are no effective workarounds for CVE-2016-10249; updating JasPer is the recommended solution.