CVE-2016-9591 — jasper: use-after-free / double-free in JPC encoder

Back Back to CVE browser

HIGH

jasper: use-after-free / double-free in JPC encoder

Published Mar 9, 2018

7.0

HIGH

CVSS 3.0

EPSS 1.40%

Description

JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer.

Affected products

Vendor JasPer Project Product Jasper Default
n/a
- Version
  2.0.12
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

JasPer Project

Jasper

n/a

Version	Status	Constraints
2.0.12	affected	-

Red Hat Enterprise Linux 6

jasper-0:1.900.1-21.el6_9

Fixed · RHSA-2017:1208
Red Hat Enterprise Linux 7

jasper-0:1.900.1-30.el7_3

Fixed · RHSA-2017:1208
Red Hat Enterprise Linux 5

netpbm

Will not fix
Red Hat Enterprise Virtualization 3

mingw-virt-viewer

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	jasper-0:1.900.1-21.el6_9	Fixed	RHSA-2017:1208
Red Hat Enterprise Linux 7	jasper-0:1.900.1-30.el7_3	Fixed	RHSA-2017:1208
Red Hat Enterprise Linux 5	netpbm	Will not fix	n/a
Red Hat Enterprise Virtualization 3	mingw-virt-viewer	Will not fix	n/a

Remediation

No remediation recorded yet.

Metrics

1.40% 0.01396

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01396

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.40% (0.01396)	71.42th	v5 (v2026.06.15)
Jun 15, 2026	1.49% (0.01488)	70.60th	v5 (v2026.06.15)
Mar 17, 2025	0.33% (0.00334)	54.08th	v4 (v2025.03.14)
Dec 12, 2024	0.11% (0.00106)	44.90th	v3 (v2023.03.01)
Sep 15, 2023	0.11% (0.00106)	42.67th	v3 (v2023.03.01)
Mar 7, 2023	0.10% (0.00103)	40.67th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Sep 10, 2022	1.02% (0.01018)	38.88th	v2 (v2022.01.01)
Apr 1, 2022	1.02% (0.01018)	36.86th	v2 (v2022.01.01)
Feb 4, 2022	1.02% (0.01018)	19.50th	v2 (v2022.01.01)

Weaknesses (1)

CWE-416

Use After Free

References (8)

http://www.securityfocus.com/bid/94952
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1208
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2016-9591
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1406405
x_refsource_CONFIRMExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-9591
https://security.gentoo.org/glsa/201707-07
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2016-9591
https://www.debian.org/security/2017/dsa-3827
vendor-advisoryx_refsource_DEBIANThird Party Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/94952		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1208		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2016-9591		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1406405		x_refsource_CONFIRMExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-9591
https://security.gentoo.org/glsa/201707-07		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2016-9591
https://www.debian.org/security/2017/dsa-3827		vendor-advisoryx_refsource_DEBIANThird Party Advisory