CVE-2016-8690: Null Pointer Dereference
Null pointer dereference vulnerability was found in bmpgetdata triggered by invoking imginfo command on specially crafted BMP image.
Upstream patch:
https://github.com/mdadams/jasper/commit/8f62b4761711d036fd8964df256b938c809b7fca
CVE assignment:
http://www.openwall.com/lists/oss-security/2016/10/16/14
Other sources
The bmpgetdata function in libjasper/bmp/bmpdec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8690?
CVE-2016-8690 is classified as a denial of service vulnerability due to a NULL pointer dereference.
How do I fix CVE-2016-8690?
To fix CVE-2016-8690, upgrade to Jasper version 1.900.9 or later.
What software is affected by CVE-2016-8690?
CVE-2016-8690 affects versions of JasPer prior to 1.900.5 and specific distributions like Fedora 23.
Can CVE-2016-8690 be exploited remotely?
Yes, CVE-2016-8690 can be exploited remotely via crafted BMP images in the imginfo command.
What should I do if I cannot upgrade due to compatibility issues related to CVE-2016-8690?
If upgrading is not possible, consider implementing additional security measures such as input validation to mitigate the impact of CVE-2016-8690.