PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2016-10250

CVE-2016-10250

jasper: Null pointer dereference in jp2_colr_destroy (incomplete fix for CVE-2016-8887)

Loading…

Severity

Moderate

Red Hat Product Security

7

CVSS 3.0

Review impact separately from score.

Published · October 18, 2016

Updated · May 13, 2026

Description

The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leveraging incorrect cleanup of JP2 box data on error. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8887.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 7
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS 2.0 · 5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P

CWE-456 · Missing Initialization of a Variable