CVE-2016-9399: High severity jasper reports vulnerability
Published Nov 21, 2016
·Updated
An assertion failure was possible to trigger in calcstepsizes.
CVE assignment:
http://seclists.org/oss-sec/2016/q4/441
Other sources
The calcstepsizes function in jpcdec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
— MITRE
Affected Software
6 affected componentsFixes available
redhat/jasper<2.0.17
2.0.17
Jasper Project Jasper=1.900.22
Fedoraproject Fedora=32
Fedoraproject Fedora=33
openSUSE Leap=15.1
openSUSE Leap=15.2
Remediation
Patch Available
Patch Available
Event History
Nov 21, 2016
Data Sourced
via Red Hat·10:22 AM
DescriptionSeverityAffected Software
Mar 23, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-9399?
CVE-2016-9399 is classified as a denial of service vulnerability.
2
How can I fix CVE-2016-9399?
To remediate CVE-2016-9399, upgrade the Jasper library to version 2.0.17 or later.
3
What software is affected by CVE-2016-9399?
CVE-2016-9399 affects versions 1.900.22 of the Jasper Project as well as specific versions in Fedora and openSUSE.
4
What type of vulnerability is CVE-2016-9399?
CVE-2016-9399 is an assertion failure vulnerability that can be triggered in the calcstepsizes function.
5
Can CVE-2016-9399 be exploited remotely?
Yes, CVE-2016-9399 can be exploited remotely, leading to a denial of service.