PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5498 Jasper Project CVE debrief

CVE-2017-5498 describes a crash condition in JasPer 1.900.17, specifically in libjasper/include/jasper/jas_math.h, where vectors involving a left shift of a negative value can trigger denial of service. The supplied NVD record rates the issue as medium severity and lists impact to availability only.

Vendor
Jasper Project
Product
CVE-2017-5498
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-01
Original CVE updated
2026-05-13
Advisory published
2017-03-01
Advisory updated
2026-05-13

Who should care

Teams that operate software or appliances bundling or linking against JasPer 1.900.17 should review exposure, especially where crashes in image or media processing would affect service availability.

Technical summary

The source corpus states that libjasper/include/jasper/jas_math.h in JasPer 1.900.17 can crash when handling inputs that lead to a left shift of a negative value. NVD records the issue with CVSS 3.0 vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H and weakness NVD-CWE-noinfo, indicating a denial-of-service condition without identified confidentiality or integrity impact. The corpus does not provide a fixed version or a more specific CWE.

Defensive priority

Medium. The vulnerability is availability-focused and rated 5.5/Medium in the supplied record, so it is important for systems where a crash would interrupt service, but it is not described as a code-execution issue in the provided sources.

Recommended defensive actions

  • Identify whether any deployed product or dependency uses JasPer 1.900.17.
  • Check the official CVE/NVD records and vendor guidance for remediation or a patched release.
  • Until remediation is confirmed, limit exposure of affected processing paths to untrusted inputs and isolate services so a crash has minimal blast radius.
  • Monitor logs and crash reports for failures originating in jas_math.h or JasPer processing paths.

Evidence notes

This debrief is based on the supplied CVE description, the NVD modified record, and the referenced Gentoo advisory. The source corpus explicitly names JasPer 1.900.17 and a crash in jas_math.h caused by a left shift of a negative value. The NVD record also provides the CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H and lists NVD-CWE-noinfo, but it does not supply a fixed version.

Official resources

The CVE was published on 2017-03-01. The supplied NVD record was last modified on 2026-05-13. The corpus also includes a Gentoo advisory reference dated 2017-01-16.