CVE-2016-9600: Null Pointer Dereference
A null pointer dereference was found in the way JasPer decoded certaion JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
Upstream bug:
https://github.com/mdadams/jasper/issues/109
Upstream fix:
https://github.com/mdadams/jasper/commit/a632c6b54bd4ffc3bebab420e00b7e7688aa3846
Other sources
JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jasperto a version that resolves this vulnerability.Fixed in 2.0.10 - Upgrade
Upgrade
JasPerto a version that resolves this vulnerability.Fixed in 2.0.10 - Compensating control
If you cannot upgrade immediately, mitigate by blocking or not processing untrusted/crafted JPEG 2000 image files in the application that uses JasPer (e.g., reject uploads and disable image decoding for untrusted sources).
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9600?
CVE-2016-9600 has a severity rating that can lead to application crashes due to null pointer dereference when processing certain JPEG 2000 files.
How do I fix CVE-2016-9600?
To fix CVE-2016-9600, update the JasPer package to version 2.0.10 or later, depending on your Linux distribution.
Which software is affected by CVE-2016-9600?
CVE-2016-9600 affects the JasPer package in versions up to 2.0.10 across multiple distributions including Debian, Red Hat, and Ubuntu.
Can CVE-2016-9600 be exploited remotely?
Yes, CVE-2016-9600 can be exploited remotely through specially crafted JPEG 2000 files.
What are the potential consequences of CVE-2016-9600?
The consequences of CVE-2016-9600 include application crashes and potential denial of service in applications using corrupted image files.