CVE-2016-9391: High severity Jasper Project Jasper vulnerability
An assertion failure was used in JPC bitstream code when integer larger than what can be handled is requested.
Upstream patch:
https://github.com/mdadams/jasper/commit/1e84674d95353c64e5c4c0e7232ae86fd6ea813b
CVE assignment:
http://seclists.org/oss-sec/2016/q4/441
Other sources
The jpcbitstreamgetbits function in jpcbs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jasperto a version that resolves this vulnerability.Fixed in 1.900.14 - Upgrade
Upgrade
JasPer (JPC bitstream code)to a version that resolves this vulnerability.Fixed in 2.0.10
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9391?
CVE-2016-9391 has a moderate severity rating, indicating it could potentially lead to application crashes.
How do I fix CVE-2016-9391?
To fix CVE-2016-9391, update to jasper version 1.900.14 or later.
What software is affected by CVE-2016-9391?
CVE-2016-9391 affects jasper versions prior to 1.900.14 on Red Hat and versions 2.0.6 and earlier on Jasper Reports.
What are the implications of CVE-2016-9391?
The implications of CVE-2016-9391 include potential application instability or crashes due to the assertion failure.
Is CVE-2016-9391 being actively exploited?
As of now, there are no publicly known exploits specifically targeting CVE-2016-9391.