The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via uns…

published 2017-03-23 9 y ago modified 2026-06-17 4 mo ago also EUVD-2016-10209

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.8%; EPSS 3.8% chance of exploitation in 30 days, percentile 89%
public exploits: 0; none known

The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.

Patch / fix

distros 2 links 3

suse opensuse

jasper SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.900.14-195.22.1
jasper SLE Module for Package Hub 15 SP1, SLE Module for Desktop Applications 15 SP2, SLE Module for Desktop Applications 15 SP1 +2 more 2.0.14-3.16.1

suse advisories SUSE-SU-2020:2690-1 SUSE-SU-2020:2689-1

jasper openSUSE Tumbleweed 2.0.33-1.2
jasper openSUSE Leap 15.2 2.0.14-lp152.7.3.1
jasper openSUSE Leap 15.1 2.0.14-lp151.4.9.1

opensuse advisories openSUSE-SU-2024:10869-1 openSUSE-SU-2020:1523-1 openSUSE-SU-2020:1517-1

blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure advisory
openwall.com/lists/oss-security/2016/11/17/1 advisory
bugzilla.redhat.com/show_bug.cgi?id=1396981 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-9399 updated 2026-11-07 cvss 5.5

jasper: reachable assertion in calcstepsizes()

Red Hat Enterprise Linux 5 netpbm Red Hat Enterprise Linux 6 jasper, jasper-libs, jasper-utils Red Hat Enterprise Linux 7 jasper, jasper-libs, jasper-utils Red Hat Enterprise Virtualization 3 mingw-virt-viewer, mingw32-virt-viewer, mingw64-virt-viewer
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux 9 jasper, jasper-libs, jasper-utils
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.76% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness

CWE-617 Reachable Assertion

References

blogs.gentoo.org /ago/2016/11/16/jasper-multiple-assertion-failure
patch, third-party-advisory
openwall.com /lists/oss-security/2016/11/17/1
mailing-list, patch, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=1396981
issue-tracking, patch, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2020-09/msg00082.html
vendor-advisory, mailing-list, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2020-09/msg00085.html
vendor-advisory, mailing-list, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/UPOVZTSIQPW2H4AFLMI3LHJEZGBVEQET/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
vendor-advisory
securityfocus.com /bid/94380
vdb-entry, third-party-advisory

Sources

CVE List CVE-2016-9399
NVD CVE-2016-9399

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary