CVE-2016-8883: Medium severity Jasper Project Jasper vulnerability
An assert that can be triggered by crafted input file was found in jpcdectiledecode().
Upstream patch:
https://github.com/mdadams/jasper/commit/33cc2cfa51a8d0fc3116d16cc1d8fc581b3f9e8d
CVE assignment:
http://seclists.org/oss-sec/2016/q4/216
Other sources
The jpcdectiledecode function in jpcdec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8883?
CVE-2016-8883 has been classified as a medium severity vulnerability that can lead to application crashes due to assertion failures.
How do I fix CVE-2016-8883?
To remediate CVE-2016-8883, update to Jasper version 1.900.8 or later as it includes the necessary patch.
What systems are affected by CVE-2016-8883?
CVE-2016-8883 affects Jasper versions prior to 1.900.8 across various platforms, including Debian and Red Hat systems.
What is the exploit nature of CVE-2016-8883?
The exploit for CVE-2016-8883 can be triggered by supplying specially crafted input files to the jpc_dec_tiledecode() function.
Is CVE-2016-8883 a remote or local vulnerability?
CVE-2016-8883 can be considered a local vulnerability as it requires crafted input to trigger the assertion failure.