CVE-2016-8654: Buffer Overflow
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size.
Upstream bugs:
https://github.com/mdadams/jasper/issues/93 https://github.com/mdadams/jasper/issues/94
Upstream patch:
https://github.com/mdadams/jasper/commit/4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1a
Other sources
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8654?
CVE-2016-8654 has a high severity rating due to the potential for remote code execution caused by the heap-buffer overflow.
How do I fix CVE-2016-8654?
To fix CVE-2016-8654, update the jasper package to version 2.0.0 or later.
Which software is affected by CVE-2016-8654?
CVE-2016-8654 affects the jasper library, especially in versions prior to 2.0.0 on systems such as Debian and Red Hat.
Can CVE-2016-8654 be exploited remotely?
Yes, CVE-2016-8654 can be exploited remotely, allowing attackers to execute arbitrary code on vulnerable systems.
What specifically causes CVE-2016-8654?
CVE-2016-8654 is caused by a buffer being allocated with too small a size in the QMFB code of the JPC codec.