CVE-2011-4517

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2011-4517
The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.kb.cert.org/vuls/id/887409 Third Party Advisory US Government Resource
https://bugzilla.redhat.com/show_bug.cgi?id=747726 Issue Tracking
http://secunia.com/advisories/47353 Not Applicable
http://www.debian.org/security/2011/dsa-2371 Third Party Advisory
http://secunia.com/advisories/47306 Not Applicable
http://www.redhat.com/support/errata/RHSA-2011-1811.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html Third Party Advisory
http://www.ubuntu.com/usn/USN-1315-1 Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-1807.html Third Party Advisory
http://osvdb.org/77596 Broken Link
http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00010.html Mailing List Third Party Advisory
http://secunia.com/advisories/47193 Not Applicable
http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071458.html Mailing List Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071561.html Mailing List Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21660640 Broken Link
http://rhn.redhat.com/errata/RHSA-2015-0698.html Third Party Advisory
http://www.securityfocus.com/bid/50992 Broken Link VDB Entry
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.538606 Release Notes
https://exchange.xforce.ibmcloud.com/vulnerabilities/71701 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:jasper_project:jasper:1.900.1:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:vmware:*:*
cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:-:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.3.5:*:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.3.7:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:redhat:enterprise_linux_desktop:4:*:*:*:*:*:*:*
History

20 Dec 2023, 18:29

Type Values Removed Values Added
First Time Suse linux Enterprise Server
Fedoraproject fedora
Debian debian Linux
Oracle outside In Technology
Canonical
Suse
Redhat
Redhat enterprise Linux Desktop
Fedoraproject
Debian
Suse linux Enterprise Desktop
Canonical ubuntu Linux
Suse linux Enterprise Software Development Kit
Oracle
CPE cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:-:*:*
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:16:*:*:*:*:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.3.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:4:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:vmware:*:*
cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
cpe:2.3:a:oracle:outside_in_technology:8.3.5:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*
CWE CWE-119 CWE-787
References (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/71701 - (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/71701 - Third Party Advisory, VDB Entry
References (SECUNIA) http://secunia.com/advisories/47306 - (SECUNIA) http://secunia.com/advisories/47306 - Not Applicable
References (REDHAT) http://www.redhat.com/support/errata/RHSA-2011-1811.html - (REDHAT) http://www.redhat.com/support/errata/RHSA-2011-1811.html - Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00010.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00010.html - Mailing List, Third Party Advisory
References (UBUNTU) http://www.ubuntu.com/usn/USN-1315-1 - (UBUNTU) http://www.ubuntu.com/usn/USN-1315-1 - Third Party Advisory
References (DEBIAN) http://www.debian.org/security/2011/dsa-2371 - (DEBIAN) http://www.debian.org/security/2011/dsa-2371 - Third Party Advisory
References (FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071458.html - (FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071458.html - Mailing List, Third Party Advisory
References (BID) http://www.securityfocus.com/bid/50992 - (BID) http://www.securityfocus.com/bid/50992 - Broken Link, VDB Entry
References (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=747726 - (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=747726 - Issue Tracking
References (CERT-VN) http://www.kb.cert.org/vuls/id/887409 - US Government Resource (CERT-VN) http://www.kb.cert.org/vuls/id/887409 - Third Party Advisory, US Government Resource
References (FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071561.html - (FEDORA) http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071561.html - Mailing List, Third Party Advisory
References (SECUNIA) http://secunia.com/advisories/47193 - (SECUNIA) http://secunia.com/advisories/47193 - Not Applicable
References (CONFIRM) http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html - (CONFIRM) http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html - Third Party Advisory
References (CONFIRM) http://www-01.ibm.com/support/docview.wss?uid=swg21660640 - (CONFIRM) http://www-01.ibm.com/support/docview.wss?uid=swg21660640 - Broken Link
References (SLACKWARE) http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.538606 - (SLACKWARE) http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.538606 - Release Notes
References (OSVDB) http://osvdb.org/77596 - (OSVDB) http://osvdb.org/77596 - Broken Link
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2015-0698.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2015-0698.html - Third Party Advisory
References (REDHAT) http://www.redhat.com/support/errata/RHSA-2011-1807.html - (REDHAT) http://www.redhat.com/support/errata/RHSA-2011-1807.html - Third Party Advisory
References (SECUNIA) http://secunia.com/advisories/47353 - (SECUNIA) http://secunia.com/advisories/47353 - Not Applicable
Information

Published : 2011-12-15 03:57

Updated : 2023-12-20 18:29

NVD link : CVE-2011-4517

Mitre link : CVE-2011-4517

JSON object : View

Products Affected

debian

  • debian_linux

fedoraproject

  • fedora

canonical

  • ubuntu_linux

jasper_project

  • jasper

redhat

  • enterprise_linux_desktop

oracle

  • outside_in_technology

suse

  • linux_enterprise_server
  • linux_enterprise_software_development_kit
  • linux_enterprise_desktop
CWE
CWE-787

Out-of-bounds Write