CVE-2016-8654

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-119

Affected software

Vendor	Product	Versions
The Jasper Project	jasper	2.0.0

References

http://www.securityfocus.com/bid/94583Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1208Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8654Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/mdadams/jasper/commit/4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1aPatch, Third Party Advisory
https://github.com/mdadams/jasper/issues/93Exploit, Third Party Advisory
https://github.com/mdadams/jasper/issues/94Exploit, Third Party Advisory
https://www.debian.org/security/2017/dsa-3785Third Party Advisory
http://www.securityfocus.com/bid/94583Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1208Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8654Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/mdadams/jasper/commit/4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1aPatch, Third Party Advisory
https://github.com/mdadams/jasper/issues/93Exploit, Third Party Advisory
https://github.com/mdadams/jasper/issues/94Exploit, Third Party Advisory
https://www.debian.org/security/2017/dsa-3785Third Party Advisory

Timeline

Published: Aug 1, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-86557.8Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of servi CVE-2016-86567.8Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result i CVE-2016-86577.8It was discovered that EAP packages in certain versions of Red Hat Enterprise Linux use incorrect permissions for /etc/sysconfig/jbossas con CVE-2016-86586.1Stack-based buffer overflow in the brcmf_cfg80211_start_ap function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Li CVE-2016-86597.0Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which might allow local users to gain privileges by attaching to the process, as demo CVE-2016-86605.5The XFS subsystem in the Linux kernel through 4.8.2 allows local users to cause a denial of service (fdatasync failure and system hang) by u CVE-2016-86618.4Little Snitch version 3.0 through 3.6.1 suffer from a buffer overflow vulnerability that could be locally exploited which could lead to an e CVE-2016-86667.5The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly h CVE-2016-86676.0The rc4030_write function in hw/dma/rc4030.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service CVE-2016-86686.0The rocker_io_writel function in hw/net/rocker/rocker.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial CVE-2016-86696.0The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denia CVE-2016-86709.8Integer signedness error in the dynamicGetbuf function in gd_io_dp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP be