There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a denial of service attack. Product bug: https://bugzilla.redhat.com/show_bug.cgi?id=1485276
Created jasper tracking bugs for this issue: Affects: fedora-all [bug 1434464] Created mingw-jasper tracking bugs for this issue: Affects: epel-7 [bug 1434465] Affects: fedora-all [bug 1434467]
hi, mostly of the recent open bugs about jasper are duplicate of this: https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure/
(In reply to Agostino Sarubbo from comment #2) > hi, mostly of the recent open bugs about jasper are duplicate of this: > https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure/ Hello Agostino, Thanks, I caught that from your post to oss-security as well. I'll duplicate them as soon as Mitre lets us know, as that's the most reliable process for us.
This CVE is for the same reachable assertion as CVE-2016-9397 (bug 1396979). Upstream bug report is: https://github.com/mdadams/jasper/issues/56 The issue remains unfixed in the current upstream version 2.0.14.