CVE-2016-9600

moderate-risk

Published 2018-03-12

JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

Do I need to act?

0.29% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (17)

Jasper

Ubuntu Linux

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Affected Vendors

Redhat Canonical Jasper Project

References (6)

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:1208

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1410026

Third Party Advisory https://usn.ubuntu.com/3693-1/

Third Party Advisory https://access.redhat.com/errata/RHSA-2017:1208

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1410026

Third Party Advisory https://usn.ubuntu.com/3693-1/

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 19/34 · Moderate