PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9560 Redhat CVE debrief

CVE-2016-9560 describes a stack-based buffer overflow in JasPer's jpc_tsfb_getbands2 function. The NVD record ties the issue to JasPer versions before 1.900.30 and downstream distro packages, and rates it HIGH with high confidentiality, integrity, and availability impact. Because the record combines a remote-attacker description with a CVSS vector of AV:L/UI:R, defenders should focus on actual image-processing exposure and patch status rather than the wording alone.

Vendor
Redhat
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-15
Original CVE updated
2026-05-13
Advisory published
2017-02-15
Advisory updated
2026-05-13

Who should care

Security teams, Linux distribution maintainers, and application owners that use JasPer or downstream packages to process JPEG 2000 images, especially where untrusted files can reach decoding workflows.

Technical summary

The vulnerable component is jpc_tsfb_getbands2 in jpc_tsfb.c. NVD classifies the weakness as CWE-787 (out-of-bounds write) and lists JasPer versions before 1.900.30 as affected. The corpus also includes downstream advisories for Debian and Red Hat, indicating packaged products were patched as part of vendor errata.

Defensive priority

High. This is a memory-corruption flaw in a commonly embedded image library, with high CVSS impact and multiple vendor advisories. Prioritize if JasPer is present in services that decode user-supplied images or in supported distro packages.

Recommended defensive actions

  • Confirm whether JasPer is installed directly or bundled through a downstream package.
  • Upgrade JasPer to 1.900.30 or apply the vendor-provided fixed package from your distribution advisory.
  • Review the status of affected downstream packages referenced by Debian DSA-3785 and Red Hat RHSA-2017:1208.
  • Restrict or monitor workflows that process untrusted JPEG 2000 images until patching is complete.
  • Validate that image-processing services are using the patched library version after remediation.

Evidence notes

The supplied corpus identifies the flaw as a stack-based buffer overflow in jpc_tsfb_getbands2, with JasPer before 1.900.30 marked vulnerable. NVD assigns CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and CWE-787. The reference set includes Debian and Red Hat advisories, an OSS-security patch discussion, and a JasPer commit, supporting both upstream and downstream remediation. The record should be interpreted using the published CVE date of 2017-02-15; later metadata modifications do not change the original issue date.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9560 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9560

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9560 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9560

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.