CVE-2016-8654

A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.

• CWE-122
• CWE-119

• http://www.securityfocus.com/bid/94583Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:1208Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8654Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/mdadams/jasper/commit/4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1aPatch, Third Party Advisory
• https://github.com/mdadams/jasper/issues/93Exploit, Third Party Advisory
• https://github.com/mdadams/jasper/issues/94Exploit, Third Party Advisory
• https://www.debian.org/security/2017/dsa-3785Third Party Advisory
• http://www.securityfocus.com/bid/94583Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:1208Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8654Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/mdadams/jasper/commit/4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1aPatch, Third Party Advisory
• https://github.com/mdadams/jasper/issues/93Exploit, Third Party Advisory
• https://github.com/mdadams/jasper/issues/94Exploit, Third Party Advisory
• https://www.debian.org/security/2017/dsa-3785Third Party Advisory

Published

Aug 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-8648It was found that the Karaf container used by Red Hat JBoss …7.2
• CVE-2016-8649lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows a…
• CVE-2016-8650The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kern…
• CVE-2016-8651An input validation flaw was found in the way OpenShift 3 ha…3.1
• CVE-2016-8652The auth component in Dovecot before 2.2.27, when auth-polic…
• CVE-2016-8653It was found that the JMX endpoint of Red Hat JBoss Fuse 6, …5.3
• CVE-2016-8655Race condition in net/packet/af_packet.c in the Linux kernel…7.8
• CVE-2016-8656Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vul…7
• CVE-2016-8657It was discovered that EAP packages in certain versions of R…
• CVE-2016-8658Stack-based buffer overflow in the brcmf_cfg80211_start_ap f…
• CVE-2016-8659Bubblewrap before 0.1.3 sets the PR_SET_DUMPABLE flag, which…
• CVE-2016-8660The XFS subsystem in the Linux kernel through 4.8.2 allows l…