CVE-2016-9591: Use After Free
A use-after-free flaw was found in the way JasPer decoded certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
Upstream issue (including a reproducer);
https://github.com/mdadams/jasper/issues/105
Other sources
JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9591?
CVE-2016-9591 has a medium severity rating due to its potential to cause application crashes.
How do I fix CVE-2016-9591?
To fix CVE-2016-9591, update the JasPer package to version 2.0.12 or later.
Which versions of JasPer are vulnerable to CVE-2016-9591?
Versions prior to 2.0.12 of the JasPer package are affected by CVE-2016-9591.
What applications are affected by CVE-2016-9591?
Applications that utilize the JasPer library for JPEG 2000 decoding are vulnerable to CVE-2016-9591.
How can I confirm if my system is affected by CVE-2016-9591?
You can check your JasPer package version against the known affected versions to determine if your system is vulnerable to CVE-2016-9591.