CVE-2016-9560: Buffer Overflow
A stack-based buffer overflow vulnerability was found in jasper in jpctsfbgetbands2 function in jpctsfb.c triggered by parsing of a malicious file.
Upstream patch:
https://github.com/mdadams/jasper/commit/1abc2e5a401a4bf1d5ca4df91358ce5df111f495
References:
http://seclists.org/oss-sec/2016/q4/473
Other sources
Stack-based buffer overflow in the jpctsfbgetbands2 function in jpctsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9560?
CVE-2016-9560 is classified as a critical vulnerability due to the potential for remote code execution through a stack-based buffer overflow.
How do I fix CVE-2016-9560?
To mitigate CVE-2016-9560, update the Jasper package to version 1.900.30 or later on affected systems.
Which software is affected by CVE-2016-9560?
CVE-2016-9560 affects the Jasper software package on various Linux distributions including Debian and Red Hat Enterprise Linux.
What does CVE-2016-9560 exploit?
CVE-2016-9560 exploits a stack-based buffer overflow vulnerability in the jpc_tsfb_getbands2 function of Jasper.
How can I verify if my system is vulnerable to CVE-2016-9560?
You can verify vulnerability to CVE-2016-9560 by checking the version of the Jasper package installed on your system.