Description
Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137.
References (6)
Core 6
Core References
Issue Tracking x_refsource_confirm
https://bugs.launchpad.net/ubuntu/+source/jasper/+bug/1547865
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2919-1
Vendor Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:1208
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/84133
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2016/dsa-3508
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/03/03/12
Scores
CVSS v3
7.6
EPSS
0.0327
EPSS Percentile
87.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Details
Status
published
Products (4)
canonical/ubuntu_linux
12.04
canonical/ubuntu_linux
14.04
canonical/ubuntu_linux
15.10
jasper_project/jasper
< 1.900.1
Published
Apr 13, 2016
Tracked Since
Feb 18, 2026