JasPer 'jpc_dec.c' Denial of Service Vulnerability

Bugtraq ID:	100861
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-14229
Remote:	Yes
Local:	No
Published:	Sep 11 2017 12:00AM
Updated:	Jan 16 2019 07:00AM
Credit:	team OWL337
Vulnerable:	Redhat RHEV-M for Servers 0 Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Redhat Enterprise Linux 5 Oracle Outside In Technology 8.5.3 JasPer JasPer 2.0.13
Not Vulnerable:

JasPer 'jpc_dec.c' Denial of Service Vulnerability

JasPer is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause a denial-of-service condition.

JasPer 2.0.13 is vulnerable; prior versions may also be affected.

JasPer 'jpc_dec.c' Denial of Service Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

JasPer 'jpc_dec.c' Denial of Service Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

JasPer 'jpc_dec.c' Denial of Service Vulnerability

References:

• CVE-2017-14229 (Redhat)
  
• Infinite loop in jpc_dec.c of Jasper. #146 (JasPer)
  
• JasPer Homepage (Micheal Adams)
  
• Bug 1058000 - (CVE-2017-14229) VUL-0: CVE-2017-14229: jasper: Infinite loop in (Novell)
  
• Bug 1491853 - (CVE-2017-14229) CVE-2017-14229 jasper: Infinite loop in jpc_dec_ (Redhat)
  
• Oracle Critical Patch Update Advisory - January 2019 (Oracle)