CVE-2016-9398

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-03-23 · updated 2026-06-17
Weakness: CWE-617

Description

The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.

Affected products

Fedoraproject Fedora: 32, 33
jasper: before 1.900.17 — fixed in 1.900.17
openSUSE Leap: 15.1, 15.2, 42.1, 42.2
SUSE Linux Enterprise Server 15 SP1: 12-sp1, 12-sp2
SUSE Linux Enterprise Server: 12-sp1, 12-sp2
SUSE Linux Enterprise Software Development Kit: 12-sp1, 12-sp2

How to fix

Upgrade to a fixed version: jasper 1.900.17. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00008.html
http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html
http://www.openwall.com/lists/oss-security/2016/11/17/1
http://www.securityfocus.com/bid/94382
https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure
https://bugzilla.redhat.com/show_bug.cgi?id=1396980
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPOVZTSIQPW2H4AFLMI3LHJEZGBVEQET/
http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00008.html
http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00009.html

Get alerted when CVE-2016-9398 or the next vulnerability affects your stack