CVE:CVE-2016-9583
CNNVD:CNNVD-201612-544
JasPer是加拿大软件开发者Michael Adams所研发的一个JPEG-2000编/解码器的开源实现。
JasPer 2.0.0版本至2.0.5版本中的jpc_t2cod.c文件的‘jpc_pi_nextpcrl()’函数存在越界读取漏洞。远程攻击者可借助特制的输入利用该漏洞在受影响应用程序上下文中执行任意代码或造成拒绝服务。
solution:Upgrade redhat enterprise_linux_desktop to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_server to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade redhat enterprise_linux_server_aus to a higher version than 7.3,7.4,7.6,and avoid the version 7.3,7.4,7.6; Upgrade redhat enterprise_linux_server_eus to a higher version than 7.3,7.4,7.5,7.6,and avoid the version 7.3,7.4,7.5,7.6; Upgrade redhat enterprise_linux_server_tus to a higher version than 7.3,7.6,and avoid the version 7.3,7.6; Upgrade redhat enterprise_linux_workstation to a higher version than 6.0,7.0,and avoid the version 6.0,7.0; Upgrade jasper_project jasper to a higher version than 2.0.6,and avoid the version (,2.0.6); Upgrade oracle outside_in_technology to a higher version than 8.5.3,and avoid the version 8.5.3