CVE-2016-8692: Divide by Zero
Published Feb 15, 2017
·Updated
The jpcdecprocesssiz function in libjasper/jpc/jpcdec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.
Affected Software
4 affected components
debian/jasper
Jasper Project Jasper<=1.900.3
Fedoraproject Fedora=25
Debian Debian Linux=8.0
Remediation
Patch Available
Event History
Feb 15, 2017
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·07:59 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-8692?
CVE-2016-8692 has a severity rating that indicates it can lead to a denial of service due to a divide-by-zero error.
2
How do I fix CVE-2016-8692?
To fix CVE-2016-8692, update to JasPer version 1.900.4 or later.
3
What type of vulnerability is CVE-2016-8692?
CVE-2016-8692 is a denial of service vulnerability caused by a divide-by-zero error in the JasPer library.
4
Which software versions are affected by CVE-2016-8692?
CVE-2016-8692 affects JasPer versions before 1.900.4, as well as specific distributions like Debian 8.0 and Fedora 25.
5
Can CVE-2016-8692 lead to an application crash?
Yes, CVE-2016-8692 can cause an application crash when processing a specially crafted BMP image.