CVE-2017-1000050

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed...

7.5 HighFix available

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

3.25%Down 4.6 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.

Record: CVE-2017-1000050
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-476
Updated: 2026-11-02

CVE List No score

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.

Record: CVE-2017-1000050
Updated: 2026-11-02

EUVDEUVD-2017-1373 No score

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.

Record: EUVD-2017-1373
Updated: 2026-11-03

GitHub AdvisoriesGHSA-29wp-q2r7-4jqv 7.5

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed...

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.

Record: GHSA-29wp-q2r7-4jqv
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSVALPINE-CVE-2017-1000050 7.5

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.

Record: ALPINE-CVE-2017-1000050
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 7.5

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.

Record: CVE-2017-1000050
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 8 moreShow less

OSVRHSA-2018:3253 5.5

Red Hat Security Advisory: jasper security update

Record: RHSA-2018:3253
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-1000050 7.5

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.

Record: UBUNTU-CVE-2017-1000050
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2017-0474 No score

Updated jasper packages fix security vulnerabilities

The jasper package has been updated and patched to fix several security issues.

Record: MGASA-2017-0474
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10869-1 No score

jasper-2.0.33-1.2 on GA media

These are all security issues fixed in the jasper-2.0.33-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10869-1
Updated: 2026-11-02

OSVSUSE-SU-2017:1901-1 No score

Security update for jasper

This update for jasper fixes the following issues:

Security issues fixed:

CVE-2016-9262: Multiple integer overflows in the jas_realloc function in base/jas_malloc.c and mem_resize function in base/jas_stream.c allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities. (bsc#1009994)
CVE-2016-9388: The ras_getcmap function in ras_dec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010975)
CVE-2016-9389: The jpc_irct and jpc_iict functions in jpc_mct.c allow remote attackers to cause a denial of service (assertion failure). (bsc#1010968)
CVE-2016-9390: The jas_seq2d_create function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010774)
CVE-2016-9391: The jpc_bitstream_getbits function in jpc_bs.c allows remote attackers to cause a denial of service (assertion failure) via a very large integer. (bsc#1010782)
CVE-2017-1000050: The jp2_encode function in jp2_enc.c allows remote attackers to cause a denial of service. (bsc#1047958)

CVEs already fixed with previous update:

CVE-2016-9392: The calcstepsizes function in jpc_dec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010757)
CVE-2016-9393: The jpc_pi_nextrpcl function in jpc_t2cod.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010766)
CVE-2016-9394: The jas_seq2d_create function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010756)

Record: SUSE-SU-2017:1901-1
Updated: 2026-11-02

OSVSUSE-SU-2017:1916-1 No score

Security update for jasper

This update for jasper fixes the following issues:

Security issues fixed:

CVE-2016-9262: Multiple integer overflows in the jas_realloc function in base/jas_malloc.c and mem_resize function in base/jas_stream.c allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities. (bsc#1009994)
CVE-2016-9388: The ras_getcmap function in ras_dec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010975)
CVE-2016-9389: The jpc_irct and jpc_iict functions in jpc_mct.c allow remote attackers to cause a denial of service (assertion failure). (bsc#1010968)
CVE-2016-9390: The jas_seq2d_create function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010774)
CVE-2016-9391: The jpc_bitstream_getbits function in jpc_bs.c allows remote attackers to cause a denial of service (assertion failure) via a very large integer. (bsc#1010782)
CVE-2017-1000050: The jp2_encode function in jp2_enc.c allows remote attackers to cause a denial of service. (bsc#1047958)

CVEs already fixed with previous update:

CVE-2016-9392: The calcstepsizes function in jpc_dec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010757)
CVE-2016-9393: The jpc_pi_nextrpcl function in jpc_t2cod.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010766)
CVE-2016-9394: The jas_seq2d_create function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010756)

Record: SUSE-SU-2017:1916-1
Updated: 2026-11-02

OSVSUSE-SU-2018:0339-1 No score

Security update for jasper

This update for jasper fixes the following issues:

Security issues fixed:

CVE-2016-9262: Multiple integer overflows in the jas_realloc function in base/jas_malloc.c and mem_resize function in base/jas_stream.c allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities. (bsc#1009994)
CVE-2016-9388: The ras_getcmap function in ras_dec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010975)
CVE-2016-9389: The jpc_irct and jpc_iict functions in jpc_mct.c allow remote attackers to cause a denial of service (assertion failure). (bsc#1010968)
CVE-2016-9390: The jas_seq2d_create function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010774)
CVE-2016-9391: The jpc_bitstream_getbits function in jpc_bs.c allows remote attackers to cause a denial of service (assertion failure) via a very large integer. (bsc#1010782)
CVE-2017-1000050: The jp2_encode function in jp2_enc.c allows remote attackers to cause a denial of service. (bsc#1047958)

CVEs already fixed with previous update:

CVE-2016-9392: The calcstepsizes function in jpc_dec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010757)
CVE-2016-9393: The jpc_pi_nextrpcl function in jpc_t2cod.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010766)
CVE-2016-9394: The jas_seq2d_create function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010756)

Record: SUSE-SU-2018:0339-1
Updated: 2026-11-02

OSVUSN-3693-1 No score

jasper vulnerabilities

It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or automated system using JasPer were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.

Record: USN-3693-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`jasper` Alpine:v3.10	before 2.0.12-r1	2.0.12-r1
`jasper` Alpine:v3.3	before 1.900.1-r13	1.900.1-r13
`jasper` Alpine:v3.4	before 1.900.1-r13	1.900.1-r13
`jasper` Alpine:v3.5	before 1.900.1-r13	1.900.1-r13
`jasper` Alpine:v3.6	before 2.0.10-r2	2.0.10-r2
`jasper` Alpine:v3.7	before 2.0.12-r1	2.0.12-r1
`jasper` Alpine:v3.8	before 2.0.12-r1	2.0.12-r1
`jasper` Alpine:v3.9	before 2.0.12-r1	2.0.12-r1
`jasper` Mageia:5 From an advisory covering 39 CVEs	before 1.900.23-1.mga5	1.900.23-1.mga5
`jasper` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7

Show 36 moreShow less

Affected packages
Package	Affected	Fixed
`jasper-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-libs` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-devel` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-utils` Red Hat:enterprise_linux:7::client From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-debuginfo` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-libs` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-devel` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-utils` Red Hat:enterprise_linux:7::computenode From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-libs` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-devel` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-utils` Red Hat:enterprise_linux:7::server From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-libs` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-devel` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper-utils` Red Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs	before 0:1.900.1-33.el7	0:1.900.1-33.el7
`jasper` SUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 9 CVEs	before 1.900.14-134.33.3.1	1.900.14-134.33.3.1
`jasper` SUSE:Linux Enterprise Server 11 SP4 From an advisory covering 9 CVEs	before 1.900.14-134.33.3.1	1.900.14-134.33.3.1
`jasper` SUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 9 CVEs	before 1.900.14-134.33.3.1	1.900.14-134.33.3.1
`jasper` SUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 9 CVEs	before 1.900.14-195.3.1	1.900.14-195.3.1
`jasper` SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 From an advisory covering 9 CVEs	before 1.900.14-195.3.1	1.900.14-195.3.1
`jasper` SUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 9 CVEs	before 1.900.14-195.3.1	1.900.14-195.3.1
`jasper` SUSE:Linux Enterprise Server 12 SP2 From an advisory covering 9 CVEs	before 1.900.14-195.3.1	1.900.14-195.3.1
`jasper` SUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 9 CVEs	before 1.900.14-195.3.1	1.900.14-195.3.1
`jasper` SUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 9 CVEs	before 1.900.14-195.5.1	1.900.14-195.5.1
`jasper` SUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 9 CVEs	before 1.900.14-195.5.1	1.900.14-195.5.1
`jasper` SUSE:Linux Enterprise Server 12 SP3 From an advisory covering 9 CVEs	before 1.900.14-195.5.1	1.900.14-195.5.1
`jasper` SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 9 CVEs	before 1.900.14-195.5.1	1.900.14-195.5.1
`jasper` Ubuntu:14.04:LTS	before 1.900.1-14ubuntu3.5, plus listed versions 1.900.1-141.900.1-14ubuntu31.900.1-14ubuntu3.11.900.1-14ubuntu3.21.900.1-14ubuntu3.31.900.1-14ubuntu3.4	1.900.1-14ubuntu3.5
`jasper` Ubuntu:16.04:LTS	before 1.900.1-debian1-2.4ubuntu1.2, plus listed versions 1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.1	1.900.1-debian1-2.4ubuntu1.2
`jasper` Ubuntu:14.04:LTS From an advisory covering 18 CVEs	before 1.900.1-14ubuntu3.5, plus listed versions 1.900.1-141.900.1-14ubuntu31.900.1-14ubuntu3.11.900.1-14ubuntu3.21.900.1-14ubuntu3.31.900.1-14ubuntu3.4	1.900.1-14ubuntu3.5
`jasper` Ubuntu:16.04:LTS From an advisory covering 18 CVEs	before 1.900.1-debian1-2.4ubuntu1.2, plus listed versions 1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.1	1.900.1-debian1-2.4ubuntu1.2
`jasper` openSUSE:Tumbleweed From an advisory covering 38 CVEs	before 2.0.33-1.2	2.0.33-1.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-1000050 is a high vulnerability (CVSS 7.5) in Jasper Project Jasper, published July 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.25%, the 88th percentile. Fixed in jasper 2.0.12-r1.

References

Show 96 moreShow less