CVE-2018-9154 Denial of service in n/a
A reachable abort in JasPer allows remote attackers to cause a denial of service via crafted image files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-9154?
CVE-2018-9154 is a high-severity denial of service vulnerability in Jasper Project Jasper, published on 4 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack by triggering an unexpected jas_alloc2 return value, a different vulnerability than CVE-2017-13745.
Weakness: CWE-20
Which versions are affected by CVE-2018-9154?
It affects 1 product.
Linux distribution packages (6)
jasper SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 2.0.14-3.11.8 |
jasper SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 2.0.14-3.11.8 |
jasper SUSE:Linux Enterprise Module for Desktop Applications 15 SP1 | All versions | 2.0.14-3.11.8 |
jasper SUSE:Linux Enterprise Module for Desktop Applications 15 SP2 | All versions | 2.0.14-3.11.8 |
jasper SUSE:Linux Enterprise Module for Package Hub 15 SP1 | All versions | 2.0.14-3.11.8 |
jasper openSUSE:Leap 15.1 | All versions | 2.0.14-lp151.4.6.1 |
Products include Jasper Project Jasper.
How do I fix CVE-2018-9154?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-9154 being exploited?
There is no known exploitation of CVE-2018-9154 in the wild and no public exploit code.
Other vulnerabilities in Jasper Project Jasper
Sources
Also known as GHSA-rvgg-59w4-c6xh, MGASA-2020-0241, SUSE-SU-2020:1420-1, SUSE-SU-2020:1420-2, UBUNTU-CVE-2018-9154, openSUSE-SU-2020:0734-1.