CVE-2022-40755
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
JasPer 3.0.6 allows denial of service via a reachable assertion in the inttobits function in libjasper/base/jas_image.c.
Risk Assessment
Processing a malicious image file could crash an application using JasPer, causing service unavailability.
Recommendation
Update JasPer to a patched version and avoid processing untrusted image files.
Other vulnerabilities in JasPer
See all- CVE-2017-14229High
There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of Jasper 2.0.13, which may lead to a remote denial of service attack.
- CVE-2017-13752High
There is a reachable assertion abort in the function jpc_dequantize() in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-13751High
There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-13750High
There is a reachable assertion abort in the function jpc_dec_process_siz() in JasPer 2.0.12 that may lead to a remote denial of service attack.
- CVE-2017-13749High
There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
- CVE-2017-13748High
There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote denial of service attack.
- CVE-2017-13747High
There is a reachable assertion abort in the function jpc_floorlog2() in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-13746High
There is a reachable assertion abort in the function jpc_dec_process_siz() in JasPer 2.0.12 that can lead to a remote denial of service attack.
- CVE-2017-1000050High
JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.
- CVE-2016-9399High
The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
Original NVD description (English source)
JasPer 3.0.6 allows denial of service via a reachable assertion in the function inttobits in libjasper/base/jas_image.c.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS