Executive brief
JasPer is a software library used for processing JPEG-2000 image files. A vulnerability exists where opening a specially crafted image file can cause the software to crash. This could lead to a denial of service for any application or system that relies on JasPer to process images.
Technical details
A denial of service vulnerability exists in the JasPer library within the jpc_dec_tiledecode function of jpc_dec.c. The issue is caused by an assertion failure (specifically `dec->numcomps >= 3`) when processing malformed JPEG-2000 image files. An attacker can exploit this by providing a specially crafted file to an application using the JasPer library, leading to an immediate application crash. This vulnerability was addressed in JasPer version 1.900.8.
Affected products
- JasPer Project JasPer before 1.900.8
Timeline
- 2016-10-22: disclosed: Vulnerability identified during fuzzing and CVE assigned by MITRE.
- 2017-01-13: advisory: NVD publication date.
- 2017-05-09: patched: Red Hat released security updates for RHEL 6 and 7.