CVE-2016-9560: debian debian_linux Out-of-bounds Write
CVSS: 7.8v3.1HighModified
AliasesUBUNTU-CVE-2016-9560
Published 15-02-2017Last modified 06-08-2024
Vulnerability summary
CVE-2016-9560 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in debian debian_linux. EPSS estimates a 2.90% chance of exploitation in the next 30 days, higher than 86.7% of scored vulnerabilities. 3 public exploits are recorded.
CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
2.90%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits3github, reference
Advisory lineage
Upstream 0 · Downstream 8 · Related 4Timeline
- 15-02-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.
CVSS metrics
4 scores · 2 sources · 3 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 2 agree
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
High 7.8Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesSingle source
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.90%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 2.90% on 18-09-2026
18-09-202618-10-2026
EPSS score2.90%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundPocs For Multi Versions
Maturity: poc
Exploit Reference (blogs.gentoo.org)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat6 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_eus7.3 | 7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus7.3 | 7.4 | 7.6 | 7.7
- enterprise_linux_server_tus7.3 | 7.6 | 7.7
Debian1 product
- debian_linuxEOL8.0
Jasper_project1 product
- jasper< 1.900.30
Ubuntu1 product
- jasper< 1.900.1-14ubuntu3.4 | < 1.900.1-debian1-2.4ubuntu1.1
4 vendors · 9 products
References
12 links
- github.com/mdadams/jasper/commit/1abc2e5a401a4bf1d5ca4df91358ce5df111f495X Refsource CONFIRMPatchThird Party Advisory
- blogs.gentoo.org/ago/2016/11/20/jasper-stack-based-buffer-overflow-in-jpc_tsfb_getbands2-jpc_tsfb-c/X Refsource MISCExploitPatchThird Party AdvisoryVDB Entry
- www.openwall.com/lists/oss-security/2016/11/23/5Mailing ListX Refsource MLISTPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2016/11/20/1Mailing ListX Refsource MLISTExploitPatchThird Party Advisory
- github.com/Hack-Me/Pocs_for_Multi_Versions/tree/main/CVE-2016-9560X Refsource MISCExploitPatchThird Party Advisory