CVE-2016-8690

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.41%

Published

Feb 15, 2017

Modified

May 12, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.

Weaknesses (CWE)

CWE-476

Affected Products (2)

jasper_project · jaspervulnerable

fedoraproject · fedoravulnerable

References (18)

http://www.openwall.com/lists/oss-security/2016/08/23/6

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/10/16/14

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/93590

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:1208

https://blogs.gentoo.org/ago/2016/10/16/jasper-two-null-pointer-dereference-in-bmp_getdata-bmp_dec-c/

ExploitPatchThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1385499

ExploitIssue TrackingPatch

https://github.com/mdadams/jasper/commit/8f62b4761711d036fd8964df256b938c809b7fca

Patch

https://lists.debian.org/debian-lts-announce/2018/11/msg00023.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22FCKKHQCQ3S6TZY5G44EFDTMWOJXJRD/

http://www.openwall.com/lists/oss-security/2016/08/23/6

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/10/16/14

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/93590

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:1208

https://blogs.gentoo.org/ago/2016/10/16/jasper-two-null-pointer-dereference-in-bmp_getdata-bmp_dec-c/

ExploitPatchThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1385499

ExploitIssue TrackingPatch

https://github.com/mdadams/jasper/commit/8f62b4761711d036fd8964df256b938c809b7fca

Patch

https://lists.debian.org/debian-lts-announce/2018/11/msg00023.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22FCKKHQCQ3S6TZY5G44EFDTMWOJXJRD/

KEV Catalog EPSS Scores Vendors All CVEs