| ID |
CVE-2016-1577
|
| Summary |
Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137. <a href="http://cwe.mitre.org/data/definitions/415.html">CWE-415: Double Free</a> |
| References |
|
| Vulnerable Configurations |
-
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
-
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
-
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
-
cpe:2.3:a:jasper_project:jasper:-:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:-:*:*:*:*:*:*:*
-
cpe:2.3:a:jasper_project:jasper:1.900.1:*:*:*:*:*:*:*
cpe:2.3:a:jasper_project:jasper:1.900.1:*:*:*:*:*:*:*
|
| CVSS |
| Base: | 6.8 (as of 05-01-2018 - 02:30) |
| Impact: | |
| Exploitability: | |
|
| CWE |
NVD-CWE-Other |
| CAPEC |
|
| Access |
| Vector | Complexity | Authentication |
| NETWORK |
MEDIUM |
NONE |
|
| Impact |
| Confidentiality | Integrity | Availability |
| PARTIAL |
PARTIAL |
PARTIAL |
|
| cvss-vector
via4
|
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
| redhat
via4
|
| advisories | | | rpms | - jasper-0:1.900.1-21.el6_9
- jasper-0:1.900.1-30.el7_3
- jasper-debuginfo-0:1.900.1-21.el6_9
- jasper-debuginfo-0:1.900.1-30.el7_3
- jasper-devel-0:1.900.1-21.el6_9
- jasper-devel-0:1.900.1-30.el7_3
- jasper-libs-0:1.900.1-21.el6_9
- jasper-libs-0:1.900.1-30.el7_3
- jasper-utils-0:1.900.1-21.el6_9
- jasper-utils-0:1.900.1-30.el7_3
|
|
| refmap
via4
|
|
| Last major update |
05-01-2018 - 02:30 |
| Published |
13-04-2016 - 14:59 |
| Last modified |
05-01-2018 - 02:30 |
