CVE-2016-10251: Integer Overflow
An integer overflow vulnerability that results into use of uninitialized value in jpcpinextcprl was found.
Upstream patch:
https://github.com/mdadams/jasper/commit/1f0dfe5a42911b6880a1445f13f6d615ddb55387
Reference:
http://seclists.org/oss-sec/2017/q1/609
Other sources
Integer overflow in the jpcpinextcprl function in jpct2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10251?
CVE-2016-10251 is considered a moderate severity vulnerability due to the potential consequences of integer overflow and use of uninitialized values.
How do I fix CVE-2016-10251?
To fix CVE-2016-10251, update the jasper package to version 1.900.20 or later for Red Hat systems, or to the latest available version for Debian systems.
Which versions are affected by CVE-2016-10251?
CVE-2016-10251 affects jasper versions earlier than 1.900.20 on Red Hat and versions up to 1.900.19 on other systems.
What software is impacted by CVE-2016-10251?
CVE-2016-10251 impacts the jasper library used for image processing across various Linux distributions including Debian and Red Hat.
Is CVE-2016-10251 being actively exploited?
There are no confirmed reports of active exploitation for CVE-2016-10251, but it is still crucial to apply the necessary patches.