CVE-2015-5221

MEDIUM

Description

Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.

References

http://lists.opensuse.org/opensuse-updates/2016-11/msg00010.html

http://lists.opensuse.org/opensuse-updates/2016-11/msg00018.html

http://lists.opensuse.org/opensuse-updates/2016-11/msg00064.html

http://www.openwall.com/lists/oss-security/2015/08/20/4

https://access.redhat.com/errata/RHSA-2017:1208

https://bugzilla.redhat.com/show_bug.cgi?id=1255710

https://github.com/mdadams/jasper/commit/df5d2867e8004e51e18b89865bc4aa69229227b3

https://lists.debian.org/debian-lts-announce/2018/11/msg00023.html

https://lists.fedoraproject.org/archives/list/[email protected]/message/3QIZNTZDXOJR5BTRZKCS3GVHVZV2PWHH/

https://lists.fedoraproject.org/archives/list/[email protected]/message/AXWV22WGSQFDRPE7G6ECGP3QXS2V2A2M/

https://lists.fedoraproject.org/archives/list/[email protected].org/message/UNLVBZWDEXZCFWOBZ3YVEQINMRBRX5QV/

https://usn.ubuntu.com/3693-1/

Details

Source: MITRE

Published: 2017-07-25

Updated: 2018-11-22

Type: CWE-416

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3.0

Base Score: 5.5

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Impact Score: 3.6

Exploitability Score: 1.8

Severity: MEDIUM

Vulnerable Software

ID	Name	Product	Family	Severity
127345	NewStart CGSL MAIN 4.05 : jasper Multiple Vulnerabilities (NS-SA-2019-0109)	Nessus	NewStart CGSL Local Security Checks	medium
119100	Debian DLA-1583-1 : jasper security update	Nessus	Debian Local Security Checks	medium
110765	Ubuntu 14.04 LTS / 16.04 LTS : jasper vulnerabilities (USN-3693-1)	Nessus	Ubuntu Local Security Checks	medium
101464	Virtuozzo 6 : jasper / jasper-devel / jasper-libs / jasper-utils (VZLSA-2017-1208)	Nessus	Virtuozzo Local Security Checks	medium
100812	EulerOS 2.0 SP2 : jasper (EulerOS-SA-2017-1095)	Nessus	Huawei Local Security Checks	medium
100811	EulerOS 2.0 SP1 : jasper (EulerOS-SA-2017-1094)	Nessus	Huawei Local Security Checks	medium
100637	Amazon Linux AMI : jasper (ALAS-2017-836)	Nessus	Amazon Linux Local Security Checks	critical
100174	CentOS 6 / 7 : jasper (CESA-2017:1208)	Nessus	CentOS Local Security Checks	medium
100120	Scientific Linux Security Update : jasper on SL6.x, SL7.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
100116	OracleVM 3.3 / 3.4 : jasper (OVMSA-2017-0102)	Nessus	OracleVM Local Security Checks	high
100093	RHEL 6 / 7 : jasper (RHSA-2017:1208)	Nessus	Red Hat Local Security Checks	medium
100089	Oracle Linux 6 / 7 : jasper (ELSA-2017-1208)	Nessus	Oracle Linux Local Security Checks	medium
94945	openSUSE Security Update : jasper (openSUSE-2016-1309)	Nessus	SuSE Local Security Checks	critical
94840	Fedora 25 : jasper (2016-9b17661de5)	Nessus	Fedora Local Security Checks	medium
94729	SUSE SLES11 Security Update : jasper (SUSE-SU-2016:2776-1)	Nessus	SuSE Local Security Checks	critical
94728	SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2016:2775-1)	Nessus	SuSE Local Security Checks	critical
94601	openSUSE Security Update : jasper (openSUSE-2016-1270)	Nessus	SuSE Local Security Checks	critical
94596	openSUSE Security Update : jasper (openSUSE-2016-1263)	Nessus	SuSE Local Security Checks	critical
93635	Fedora 23 : jasper (2016-bbecf64af4)	Nessus	Fedora Local Security Checks	medium
92972	Fedora 24 : jasper (2016-7776983633)	Nessus	Fedora Local Security Checks	medium
85523	FreeBSD : jasper -- multiple vulnerabilities (f1692469-45ce-11e5-adde-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium