CVE-2016-9557
Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a...
CVE-2016-9557 is a medium vulnerability (CVSS 5.5) in Jasper Project Jasper, published March 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.92%, the 79th percentile. Fixed in jasper 1.900.23-1.mga5.
Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
CVE-2016-9557- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
CVE-2016-9557- Updated
- 2026-11-02
EUVDEUVD-2016-10363 No score
Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
EUVD-2016-10363- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q4c4-wm35-x9g8
Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a...
Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
GHSA-q4c4-wm35-x9g8- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
CVE-2016-9557- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-9557
Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file.
- Record
UBUNTU-CVE-2016-9557- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0474 No score
Updated jasper packages fix security vulnerabilities
The jasper package has been updated and patched to fix several security issues.
- Record
MGASA-2017-0474- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10869-1 No score
jasper-2.0.33-1.2 on GA media
These are all security issues fixed in the jasper-2.0.33-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10869-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2690-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
- CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
- CVE-2016-9397: Fix assert in jpc_dequantize (bsc#1010786).
- CVE-2016-9557: Fix signed integer overflow (bsc#1011829).
- CVE-2017-5499: Validate component depth bit (bsc#1020451).
- CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
- CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
- CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
- CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
- CVE-2018-9154: Fixed a potential denial of service in jpc_dec_process_sot() (bsc#1092115).
- CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
- CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
- CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
- CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
- CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
- CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
- Record
SUSE-SU-2020:2690-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jasperMageia:5 |
before 1.900.23-1.mga5 | 1.900.23-1.mga5 |
jasperSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperSUSE:Linux Enterprise Server 12 SP5 |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperUbuntu:16.04:LTS |
All versions, plus listed versions 1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.11.900.1-debian1-2.4ubuntu1.21.900.1-debian1-2.4ubuntu1.3 |
None known |
jasperopenSUSE:Tumbleweed |
before 2.0.33-1.2 | 2.0.33-1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/94490
blogs.gentoo.org/ago/2016/11/19/jasper-signed-integer-overflow-in-jas_image-c
bugzilla.redhat.com/show_bug.cgi?id=1398251
github.com/mdadams/jasper/commit/d42b2388f7f8e0332c846675133acea151fc557a
openwall.com/lists/oss-security/2016/11/23/2
nvd.nist.gov/vuln/detail/CVE-2016-9557
Show 73 moreShow less
advisories.mageia.org/MGASA-2017-0474.html
bugs.mageia.org/show_bug.cgi?id=19605
lists.fedoraproject.org/archives/list/[email protected]/thread/THLEZURI4D24PRM7SMASC5I25IAWXXTM
lists.opensuse.org/opensuse-updates/2016-11/msg00010.html
suse.com/support/update/announcement/2020/suse-su-20202690-1
bugzilla.suse.com/1010786
ubuntu.com/security/CVE-2016-9557
cve.org/CVERecord?id=CVE-2016-9557