CVE-2017-5505
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a...
5.5 Medium
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
2.07%Down 0.5 points since Apr 14, 2021
What each source reports
NVD Score used
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
- Record
CVE-2017-5505- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
- Record
CVE-2017-5505- Updated
- 2026-11-02
EUVDEUVD-2017-14609 No score
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
- Record
EUVD-2017-14609- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jcmq-p3g6-5394
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a...
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
- Record
GHSA-jcmq-p3g6-5394- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV
The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
- Record
CVE-2017-5505- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1517-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
- CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
- CVE-2017-5499: Validate component depth bit (bsc#1020451).
- CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
- CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
- CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
- CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
- CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
- CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
- CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
- CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
- CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
- CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:1517-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1523-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
- CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
- CVE-2017-5499: Validate component depth bit (bsc#1020451).
- CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
- CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
- CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
- CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
- CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
- CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
- CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
- CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
- CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
- CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2020:1523-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2689-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
- CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
- CVE-2017-5499: Validate component depth bit (bsc#1020451).
- CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
- CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
- CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
- CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
- CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
- CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
- CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
- CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
- CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
- CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
- Record
SUSE-SU-2020:2689-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2690-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
- CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
- CVE-2016-9397: Fix assert in jpc_dequantize (bsc#1010786).
- CVE-2016-9557: Fix signed integer overflow (bsc#1011829).
- CVE-2017-5499: Validate component depth bit (bsc#1020451).
- CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
- CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
- CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
- CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
- CVE-2018-9154: Fixed a potential denial of service in jpc_dec_process_sot() (bsc#1092115).
- CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
- CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
- CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
- CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
- CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
- CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
- Record
SUSE-SU-2020:2690-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jasperSUSE:Linux Enterprise Module for Basesystem 15 SP1 From an advisory covering 14 CVEs |
before 2.0.14-3.16.1 | 2.0.14-3.16.1 |
jasperSUSE:Linux Enterprise Module for Basesystem 15 SP2 From an advisory covering 14 CVEs |
before 2.0.14-3.16.1 | 2.0.14-3.16.1 |
jasperSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 From an advisory covering 14 CVEs |
before 2.0.14-3.16.1 | 2.0.14-3.16.1 |
jasperSUSE:Linux Enterprise Module for Desktop Applications 15 SP2 From an advisory covering 14 CVEs |
before 2.0.14-3.16.1 | 2.0.14-3.16.1 |
jasperSUSE:Linux Enterprise Module for Package Hub 15 SP1 From an advisory covering 14 CVEs |
before 2.0.14-3.16.1 | 2.0.14-3.16.1 |
jasperSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 17 CVEs |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 17 CVEs |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 17 CVEs |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperopenSUSE:Leap 15.1 From an advisory covering 14 CVEs |
before 2.0.14-lp151.4.9.1 | 2.0.14-lp151.4.9.1 |
jasperopenSUSE:Leap 15.2 From an advisory covering 14 CVEs |
before 2.0.14-lp152.7.3.1 | 2.0.14-lp152.7.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5505 is a medium vulnerability (CVSS 5.5) in Jasper Project Jasper, published March 16, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. No source names a fixed version.
References
openwall.com/lists/oss-security/2017/01/17/4
blogs.gentoo.org/ago/2017/01/16/jasper-invalid-memory-read-in-jas_matrix_asl-jas_seq-c
securityfocus.com/bid/95687
security.gentoo.org/glsa/201908-03
lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html
Show 41 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-5505
github.com/advisories/GHSA-jcmq-p3g6-5394
suse.com/support/update/announcement/2020/suse-su-20202689-1
bugzilla.suse.com/1010979