CVE-2016-10248

HIGH 7.5CVE-2016-10248 · Published 15/03/2017 · updated 17/06/2026

In short

CVE-2016-10248 is a HIGH (CVSS 7.5) vulnerability affecting jasper (jasper project).
Chance of exploitation in the next 30 days (EPSS): 4.0%, higher than 90.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
jasper jasper_project	`≤ 1.900.8`	No fix yet

Description

The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.

References

securityfocus.com/bid/93797
access.redhat.com/errata/RHSA-2017:1208
blogs.gentoo.org/ago/2016/10/20/jasper-null-pointer-dereference-in-jpc_tsfb_synthesize-jpc_tsfb-c · Exploit
mdadams/jasper commit 2e82fa0 · Patch
usn.ubuntu.com/3693-1

More vulnerabilities in jasper

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

jasper

jasper_project

≤ 1.900.8

No fix yet

More vulnerabilities in jasper

See all →