CVE-2016-9397
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a...
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
- Record
CVE-2016-9397- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-617
- Updated
- 2026-11-02
CVE List No score
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
- Record
CVE-2016-9397- Updated
- 2026-11-02
EUVDEUVD-2016-10207 No score
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
- Record
EUVD-2016-10207- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7q5j-5v5r-g4wc
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a...
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
- Record
GHSA-7q5j-5v5r-g4wc- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSV
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
- Record
CVE-2016-9397- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-9397
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
- Record
UBUNTU-CVE-2016-9397- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0474 No score
Updated jasper packages fix security vulnerabilities
The jasper package has been updated and patched to fix several security issues.
- Record
MGASA-2017-0474- Updated
- 2026-11-02
OSVSUSE-SU-2020:2690-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
- CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
- CVE-2016-9397: Fix assert in jpc_dequantize (bsc#1010786).
- CVE-2016-9557: Fix signed integer overflow (bsc#1011829).
- CVE-2017-5499: Validate component depth bit (bsc#1020451).
- CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
- CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
- CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
- CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
- CVE-2018-9154: Fixed a potential denial of service in jpc_dec_process_sot() (bsc#1092115).
- CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
- CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
- CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
- CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
- CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
- CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
- Record
SUSE-SU-2020:2690-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jasperMageia:5 |
before 1.900.23-1.mga5 | 1.900.23-1.mga5 |
jasperSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperSUSE:Linux Enterprise Server 12 SP5 |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.900.14-195.22.1 | 1.900.14-195.22.1 |
jasperUbuntu:16.04:LTS |
All versions, plus listed versions 1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.11.900.1-debian1-2.4ubuntu1.21.900.1-debian1-2.4ubuntu1.3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-9397 is a high vulnerability (CVSS 7.5) in Jasper Project Jasper, published March 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.93%, the 90th percentile. Fixed in jasper 1.900.23-1.mga5.
References
bugzilla.redhat.com/show_bug.cgi?id=1396979
blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure
openwall.com/lists/oss-security/2016/11/17/1
securityfocus.com/bid/94373
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPOVZTSIQPW2H4AFLMI3LHJEZGBVEQET
Show 51 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-9397
github.com/advisories/GHSA-7q5j-5v5r-g4wc
advisories.mageia.org/MGASA-2017-0474.html
bugs.mageia.org/show_bug.cgi?id=19605
lists.opensuse.org/opensuse-updates/2016-11/msg00010.html
suse.com/support/update/announcement/2020/suse-su-20202690-1
bugzilla.suse.com/1010786
ubuntu.com/security/CVE-2016-9397
cve.org/CVERecord?id=CVE-2016-9397