CVE-2017-5504
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers...
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
- Record
CVE-2017-5504- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
- Record
CVE-2017-5504- Updated
- 2026-11-02
EUVDEUVD-2017-14608 No score
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
- Record
EUVD-2017-14608- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pp94-jcg6-7m7g
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers...
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
- Record
GHSA-pp94-jcg6-7m7g- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
- Record
CVE-2017-5504- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5504
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
- Record
UBUNTU-CVE-2017-5504- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2020:1517-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
- CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
- CVE-2017-5499: Validate component depth bit (bsc#1020451).
- CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
- CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
- CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
- CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
- CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
- CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
- CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
- CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
- CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
- CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:1517-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1523-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
- CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
- CVE-2017-5499: Validate component depth bit (bsc#1020451).
- CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
- CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
- CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
- CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
- CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
- CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
- CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
- CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
- CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
- CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:1523-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2689-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
- CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
- CVE-2017-5499: Validate component depth bit (bsc#1020451).
- CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
- CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
- CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
- CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
- CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
- CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
- CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
- CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
- CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
- CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
- Record
SUSE-SU-2020:2689-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2690-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
- CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
- CVE-2016-9397: Fix assert in jpc_dequantize (bsc#1010786).
- CVE-2016-9557: Fix signed integer overflow (bsc#1011829).
- CVE-2017-5499: Validate component depth bit (bsc#1020451).
- CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
- CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
- CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
- CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
- CVE-2018-9154: Fixed a potential denial of service in jpc_dec_process_sot() (bsc#1092115).
- CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
- CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
- CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
- CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
- CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
- CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
- Record
SUSE-SU-2020:2690-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jasperSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 14 CVEs |
before 2.0.14-3.16.1 | 2.0.14-3.16.1 |
jasperSUSE:Linux Enterprise Module for Basesystem 15 SP2 From an advisory covering 14 CVEs |
before 2.0.14-3.16.1 | 2.0.14-3.16.1 |
jasperSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 14 CVEs |
before 2.0.14-3.16.1 | 2.0.14-3.16.1 |
jasperSUSE:Linux Enterprise Module for Desktop Applications 15 SP2 From an advisory covering 14 CVEs |
before 2.0.14-3.16.1 | 2.0.14-3.16.1 |
jasperSUSE:Linux Enterprise Module for Package Hub 15 SP1 From an advisory covering 14 CVEs |
before 2.0.14-3.16.1 | 2.0.14-3.16.1 |
jasperSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 17 CVEs |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 17 CVEs |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 17 CVEs |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperUbuntu:16.04:LTS |
All versions, plus listed versions 1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.11.900.1-debian1-2.4ubuntu1.21.900.1-debian1-2.4ubuntu1.3 |
None known |
jasperopenSUSE:Leap 15.1 From an advisory covering 14 CVEs |
before 2.0.14-lp151.4.9.1 | 2.0.14-lp151.4.9.1 |
jasperopenSUSE:Leap 15.2 From an advisory covering 14 CVEs |
before 2.0.14-lp152.7.3.1 | 2.0.14-lp152.7.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5504 is a medium vulnerability (CVSS 5.5) in Jasper Project Jasper, published March 1, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.61%, the 76th percentile. No source names a fixed version.
References
blogs.gentoo.org/ago/2017/01/16/jasper-invalid-memory-read-in-jpc_undo_roi-jpc_dec-c
securityfocus.com/bid/95682
security.gentoo.org/glsa/201908-03
lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html
nvd.nist.gov/vuln/detail/CVE-2017-5504
Show 41 moreShow less
github.com/advisories/GHSA-pp94-jcg6-7m7g
suse.com/support/update/announcement/2020/suse-su-20202689-1
bugzilla.suse.com/1010979
ubuntu.com/security/CVE-2017-5504
cve.org/CVERecord?id=CVE-2017-5504