NULL pointer dereference in JasPer - CVE-2017-1000050

Vulnerability identifier: #VU15956

CSH Severity: Low

CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-1000050

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component. A remote attacker can supply specially crafted input and perform a denial of service (DoS) attack.

JasPer
jasper (Alpine package)
jasper
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Fedora

Install updates from vendor's website.

jasper (Alpine package) - addressed in versions 1.900.1-r13, 2.0.10-r2
jasper - addressed in versions 2.0.14-1.fc26, 2.0.14-1.fc27

• http://www.openwall.com/lists/oss-security/2017/03/06/1
• http://www.securityfocus.com/bid/96595
• https://access.redhat.com/errata/RHSA-2018:3253
• https://access.redhat.com/errata/RHSA-2018:3505

• Denial of service in JasPer
• Red Hat update for jasper
• NULL pointer dereference in jasper (Alpine package)
• Fedora 27 update for jasper
• Fedora 26 update for jasper