CVE-2015-5221medium
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
References
http://lists.opensuse.org/opensuse-updates/2016-11/msg00010.html
http://lists.opensuse.org/opensuse-updates/2016-11/msg00018.html
http://lists.opensuse.org/opensuse-updates/2016-11/msg00064.html
http://www.openwall.com/lists/oss-security/2015/08/20/4
https://access.redhat.com/errata/RHSA-2017:1208
https://bugzilla.redhat.com/show_bug.cgi?id=1255710
https://github.com/mdadams/jasper/commit/df5d2867e8004e51e18b89865bc4aa69229227b3
https://lists.debian.org/debian-lts-announce/2018/11/msg00023.html
Details
Source: MITRE
Published: 2017-07-25
Updated: 2018-11-22
Type: CWE-416
Risk Information
CVSS v2
Base Score: 4.3
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3
Base Score: 5.5
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 1.8
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
Configuration 2
OR
cpe:2.3:o:opensuse:leap:42.2:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Configuration 3
OR
cpe:2.3:a:jasper_project:jasper:*:*:*:*:*:*:*:* versions up to 1.900.1 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 127345 | NewStart CGSL MAIN 4.05 : jasper Multiple Vulnerabilities (NS-SA-2019-0109) | Nessus | NewStart CGSL Local Security Checks | high |
| 119100 | Debian DLA-1583-1 : jasper security update | Nessus | Debian Local Security Checks | high |
| 110765 | Ubuntu 14.04 LTS / 16.04 LTS : JasPer vulnerabilities (USN-3693-1) | Nessus | Ubuntu Local Security Checks | high |
| 101464 | Virtuozzo 6 : jasper / jasper-devel / jasper-libs / jasper-utils (VZLSA-2017-1208) | Nessus | Virtuozzo Local Security Checks | high |
| 100812 | EulerOS 2.0 SP2 : jasper (EulerOS-SA-2017-1095) | Nessus | Huawei Local Security Checks | high |
| 100811 | EulerOS 2.0 SP1 : jasper (EulerOS-SA-2017-1094) | Nessus | Huawei Local Security Checks | high |
| 100637 | Amazon Linux AMI : jasper (ALAS-2017-836) | Nessus | Amazon Linux Local Security Checks | critical |
| 100174 | CentOS 6 / 7 : jasper (CESA-2017:1208) | Nessus | CentOS Local Security Checks | high |
| 100120 | Scientific Linux Security Update : jasper on SL6.x, SL7.x i386/x86_64 (20170509) | Nessus | Scientific Linux Local Security Checks | high |
| 100116 | OracleVM 3.3 / 3.4 : jasper (OVMSA-2017-0102) | Nessus | OracleVM Local Security Checks | high |
| 100093 | RHEL 6 / 7 : jasper (RHSA-2017:1208) | Nessus | Red Hat Local Security Checks | high |
| 100089 | Oracle Linux 6 / 7 : jasper (ELSA-2017-1208) | Nessus | Oracle Linux Local Security Checks | high |
| 94945 | openSUSE Security Update : jasper (openSUSE-2016-1309) | Nessus | SuSE Local Security Checks | high |
| 94840 | Fedora 25 : jasper (2016-9b17661de5) | Nessus | Fedora Local Security Checks | high |
| 94729 | SUSE SLES11 Security Update : jasper (SUSE-SU-2016:2776-1) | Nessus | SuSE Local Security Checks | high |
| 94728 | SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2016:2775-1) | Nessus | SuSE Local Security Checks | high |
| 94601 | openSUSE Security Update : jasper (openSUSE-2016-1270) | Nessus | SuSE Local Security Checks | high |
| 94596 | openSUSE Security Update : jasper (openSUSE-2016-1263) | Nessus | SuSE Local Security Checks | high |
| 93635 | Fedora 23 : jasper (2016-bbecf64af4) | Nessus | Fedora Local Security Checks | high |
| 92972 | Fedora 24 : jasper (2016-7776983633) | Nessus | Fedora Local Security Checks | high |
| 85523 | FreeBSD : jasper -- multiple vulnerabilities (f1692469-45ce-11e5-adde-14dae9d210b8) | Nessus | FreeBSD Local Security Checks | medium |