CVE catalog

CVE-2016-9388

Security update for jasper

[CVE catalog]

Severity
Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.95% · Oct 25, 2026

The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntujasper14.041.900.1-14vulnerable
Ubuntujasper14.041.900.1-14ubuntu3vulnerable
Ubuntujasper14.041.900.1-14ubuntu3.1vulnerable
Ubuntujasper14.041.900.1-14ubuntu3.2vulnerable
Ubuntujasper14.041.900.1-14ubuntu3.3vulnerable
Ubuntujasper14.041.900.1-14ubuntu3.4vulnerable
Ubuntujasper14.041.900.1-14ubuntu3.5fixed
Ubuntujasper16.041.900.1-debian1-2.4vulnerable
Ubuntujasper16.041.900.1-debian1-2.4ubuntu1vulnerable
Ubuntujasper16.041.900.1-debian1-2.4ubuntu1.1vulnerable
Ubuntujasper16.041.900.1-debian1-2.4ubuntu1.2fixed
Susejasperlinux enterprise desktop 12 sp21.900.14-195.3.1fixed
Susejasperlinux enterprise server for raspberry pi 12 sp21.900.14-195.3.1fixed
Susejasperlinux enterprise software development kit 12 sp21.900.14-195.3.1fixed
Susejasperlinux enterprise server 12 sp21.900.14-195.3.1fixed
Susejasperlinux enterprise server for sap applications 12 sp21.900.14-195.3.1fixed
Susejasperlinux enterprise desktop 12 sp31.900.14-195.5.1fixed
Susejasperlinux enterprise software development kit 12 sp31.900.14-195.5.1fixed
Susejasperlinux enterprise server 12 sp31.900.14-195.5.1fixed
Susejasperlinux enterprise server for sap applications 12 sp31.900.14-195.5.1fixed
Susejasperlinux enterprise software development kit 11 sp41.900.14-134.33.3.1fixed
Susejasperlinux enterprise server 11 sp41.900.14-134.33.3.1fixed
Susejasperlinux enterprise server for sap applications 11 sp41.900.14-134.33.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntujasperdeb14.041.900.1-14ubuntu3.5Not reportedUBUNTU-CVE-2016-9388Not reported
Ubuntujasperdeb16.041.900.1-debian1-2.4ubuntu1.2Not reportedUBUNTU-CVE-2016-9388Not reported
Susejasperrpmlinux enterprise desktop 12 sp21.900.14-195.3.1Not reportedSUSE-SU-2017:1916-1Not reported
Susejasperrpmlinux enterprise server for raspberry pi 12 sp21.900.14-195.3.1Not reportedSUSE-SU-2017:1916-1Not reported
Susejasperrpmlinux enterprise software development kit 12 sp21.900.14-195.3.1Not reportedSUSE-SU-2017:1916-1Not reported
Susejasperrpmlinux enterprise server 12 sp21.900.14-195.3.1Not reportedSUSE-SU-2017:1916-1Not reported
Susejasperrpmlinux enterprise server for sap applications 12 sp21.900.14-195.3.1Not reportedSUSE-SU-2017:1916-1Not reported
Susejasperrpmlinux enterprise desktop 12 sp31.900.14-195.5.1Not reportedSUSE-SU-2018:0339-1Not reported
Susejasperrpmlinux enterprise software development kit 12 sp31.900.14-195.5.1Not reportedSUSE-SU-2018:0339-1Not reported
Susejasperrpmlinux enterprise server 12 sp31.900.14-195.5.1Not reportedSUSE-SU-2018:0339-1Not reported
Susejasperrpmlinux enterprise server for sap applications 12 sp31.900.14-195.5.1Not reportedSUSE-SU-2018:0339-1Not reported
Susejasperrpmlinux enterprise software development kit 11 sp41.900.14-134.33.3.1Not reportedSUSE-SU-2017:1901-1Not reported
Susejasperrpmlinux enterprise server 11 sp41.900.14-134.33.3.1Not reportedSUSE-SU-2017:1901-1Not reported
Susejasperrpmlinux enterprise server for sap applications 11 sp41.900.14-134.33.3.1Not reportedSUSE-SU-2017:1901-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]