CVE-2016-9560

Опубликовано: 15 фев. 2017

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.

Ссылки

http://www.debian.org/security/2017/dsa-3785
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/11/20/1
Exploit
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/11/23/5
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/94428
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2017:1208
Third Party Advisory
https://blogs.gentoo.org/ago/2016/11/20/jasper-stack-based-buffer-overflow-in-jpc_tsfb_getbands2-jpc_tsfb-c/
Exploit
Patch
Third Party Advisory
VDB Entry
https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2016-9560
Exploit
Patch
Third Party Advisory
https://github.com/mdadams/jasper/commit/1abc2e5a401a4bf1d5ca4df91358ce5df111f495
Patch
Third Party Advisory
http://www.debian.org/security/2017/dsa-3785
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/11/20/1
Exploit
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/11/23/5
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/94428
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2017:1208
Third Party Advisory
https://blogs.gentoo.org/ago/2016/11/20/jasper-stack-based-buffer-overflow-in-jpc_tsfb_getbands2-jpc_tsfb-c/
Exploit
Patch
Third Party Advisory
VDB Entry
https://github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2016-9560
Exploit
Patch
Third Party Advisory
https://github.com/mdadams/jasper/commit/1abc2e5a401a4bf1d5ca4df91358ce5df111f495
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jasper_project:jasper:*:*:*:*:*:*:*:*

Версия до 1.900.30 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.00401

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787

Связанные уязвимости

CVE-2016-9560

CVSS3: 7.8

ubuntu

больше 8 лет назад

Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.

CVE-2016-9560

CVSS3: 7.8

redhat

почти 9 лет назад

Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.

CVE-2016-9560

CVSS3: 7.8

debian

больше 8 лет назад

Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_ ...

GHSA-wf8h-4pv3-m27q

CVSS3: 7.8

github

больше 3 лет назад

Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.

openSUSE-SU-2017:0101-1

suse-cvrf

почти 9 лет назад

Security update for jasper

EPSS

Процентиль: 60%

0.00401

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-787