CVE-2018-9154: Input Validation

Published May 4, 2018

Updated

There is a reachable abort in the function jpcdecprocesssot in libjasper/jpc/jpcdec.c of JasPer 2.0.14 that will lead to a remote denial of service attack by triggering an unexpected jasalloc2 return value, a different vulnerability than CVE-2017-13745.

Affected Software

1 affected component

Jasper Project Jasper=2.0.14

Event History

May 4, 2018

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Data Sourced

via NVD·09:29 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2018-9154?

CVE-2018-9154 is a vulnerability in JasPer 2.0.14 that can be exploited to cause a remote denial of service attack.

How severe is the vulnerability CVE-2018-9154?

The severity of CVE-2018-9154 is high, with a CVSS score of 7.5.

How can CVE-2018-9154 be exploited?

CVE-2018-9154 can be exploited by triggering an unexpected jas_alloc2 return value.

How can I fix the vulnerability CVE-2018-9154?

To fix CVE-2018-9154, it is recommended to update to the latest version of JasPer.

Where can I find more information about CVE-2018-9154?

More information about CVE-2018-9154 can be found in the following references: [1](https://drive.google.com/drive/u/2/folders/1YuxdfbZrw79kfzoQz0PpxIutZ7pkf_kW), [2](https://security.gentoo.org/glsa/201908-03), [3](https://www.oracle.com/security-alerts/cpuapr2020.html).