#VU31249 Out-of-bounds read in JasPer - CVE-2016-9583

Vulnerability identifier: #VU31249

Vulnerability risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9583

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
JasPer
Client/Desktop applications / Multimedia software

Vendor: The JasPer Project

Description

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.

Mitigation
Install update from vendor's website.

Vulnerable software versions

JasPer: 2.0.0

---

External links
https://www.securityfocus.com/bid/94925
https://access.redhat.com/errata/RHSA-2017:1208
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9583
https://github.com/mdadams/jasper/commit/aa0b0f79ade5eef8b0e7a214c03f5af54b36ba7d
https://github.com/mdadams/jasper/commit/f25486c3d4aa472fec79150f2c41ed4333395d3d
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.