Out-of-bounds read in JasPer

1) Out-of-bounds read

EUVDB-ID: #VU31249

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9583

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.

Mitigation

Install update from vendor's website.

Vulnerable software versions

JasPer: 2.0.0

CPE2.3

• cpe:2.3:a:the_jasper_project:jasper:2.0.0:*:*:*:*:*:*:*

External links

https://www.securityfocus.com/bid/94925
https://access.redhat.com/errata/RHSA-2017:1208
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9583
https://github.com/mdadams/jasper/commit/aa0b0f79ade5eef8b0e7a214c03f5af54b36ba7d
https://github.com/mdadams/jasper/commit/f25486c3d4aa472fec79150f2c41ed4333395d3d
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.