Executive brief
JasPer is a software library used for processing JPEG-2000 images. A vulnerability exists where a specially crafted image file can cause the software to crash. This results in a denial of service, potentially disrupting applications or services that rely on JasPer to process user-supplied images.
Technical details
A NULL pointer dereference vulnerability exists in the JasPer library within the jpc_dec_tilefini function in jpc_dec.c (and subsequently jpc_pi_destroy in jpc_t2cod.c). The issue is triggered when the library processes a malformed JPEG-2000 image file. An attacker can exploit this by providing a crafted file to an application using the JasPer library, leading to a segmentation fault and application crash. This vulnerability was identified via fuzzing with American Fuzzy Lop (AFL). The issue is resolved in JasPer version 1.900.8.
Affected products
- JasPer Project JasPer before 1.900.8
Timeline
- 2016-10-16: disclosed: Issue reported on GitHub by Hanno Böck
- 2016-10-23: advisory: CVE-2016-8882 assigned by MITRE
- 2017-01-13: advisory: NVD publication date
- 2017-02-09: patched: Debian released security update DSA-3785-1