CVE-2016-8692

The jpcdecprocesssiz function in libjasper/jpc/jpcdec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.

References

Affected packages

Git / github.com/jasper-software/jasper

Affected ranges

Type: GIT
Repo: https://github.com/jasper-software/jasper
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

d8c2604cd438c41ec72aff52c16ebd8183068020

Affected versions

version-1.*

version-1.900.1

version-1.900.2

version-1.900.3

Database specific

vanir_signatures

[
    {
        "id": "CVE-2016-8692-0cce8fe9",
        "target": {
            "function": "jpc_siz_getparms",
            "file": "src/libjasper/jpc/jpc_cs.c"
        },
        "digest": {
            "length": 1235.0,
            "function_hash": "94188601995937479999006365181574232397"
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function",
        "source": "https://github.com/jasper-software/jasper/commit/d8c2604cd438c41ec72aff52c16ebd8183068020"
    }
]

Git / github.com/jasper-software/jasper

Affected ranges

Type: GIT
Repo: https://github.com/mdadams/jasper
Events: Introduced

0 Unknown introduced commit / All previous commits are affected