High
Security advisory
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-8654
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:09 UTC · Revision 1
Source evidence
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
osv:CVE-2016-8654
Complete source record
{
"id": "fa0fa66b0787f782c57c531b9aa7c363135eefd0a36b8c7bb04ff2a1079c757c",
"url": "https://osv.dev/vulnerability/CVE-2016-8654",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-8654",
"summary": "A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.",
"evidence": "osv:CVE-2016-8654",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-8654",
"aliases": [
"CVE-2016-8654"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jasper-software/jasper",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "58b2bc12f377e64fca99ea7f3517d7fff1c39ac9"
},
{
"fixed": "4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:jasper_project:jasper:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1a"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"version-2.0.0-beta.2",
"version-2.0.0-beta.1",
"version-1.900.31",
"version-1.900.30",
"version-1.900.29",
"version-1.900.28",
"version-1.900.27",
"version-1.900.26",
"version-1.900.25",
"version-1.900.24",
"version-1.900.23",
"version-1.900.22",
"version-1.900.21",
"version-1.900.20",
"version-1.900.19",
"mdadams-clang-issue",
"version-1.900.18",
"version-1.900.17",
"version-1.900.16",
"version-1.900.15",
"version-1.900.14",
"version-1.900.13",
"version-1.900.12",
"version-1.900.11",
"version-1.900.10",
"version-1.900.9",
"version-1.900.8",
"version-1.900.7",
"version-1.900.6",
"version-1.900.5",
"version-1.900.4",
"version-1.900.3",
"version-1.900.2",
"version-1.900.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-8654.json",
"vanir_signatures": [
{
"id": "CVE-2016-8654-0dcf8ffb",
"digest": {
"length": 1346,
"function_hash": "186195089228374234410065704768766963377"
},
"source": "https://github.com/jasper-software/jasper/commit/4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1a",
"target": {
"file": "src/libjasper/jpc/jpc_qmfb.c",
"function": "jpc_qmfb_split_colgrp"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-8654-1694dfe7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"91439763672008926014304468047359040463",
"39422614836085523475719587765514811988",
"66214935530393369936941939654568573157",
"223093940676283065771569038798405738741",
"19944127579799130453828704799952755182",
"337567256585894419231491724210265492739",
"62682416456756734888778215733668874549",
"111945803449391037881280178009045452010",
"54154213729979605192265990114048829584",
"199940814023961152752121388932698874529",
"299475768269001199775499735647832994195",
"181244372587943920516132100894316807453",
"332017236802858246829452018839956202615",
"48490655970433916981635400964725131650",
"244090500458065342013403445253238116896",
"231998259697245499165510730504102844654",
"223093940676283065771569038798405738741",
"37252762511398032756581321201460685593",
"95959080991199268081408047512902503450",
"228213796523644901293057852217498264196",
"19944127579799130453828704799952755182",
"337567256585894419231491724210265492739",
"62682416456756734888778215733668874549",
"111945803449391037881280178009045452010",
"54154213729979605192265990114048829584",
"199940814023961152752121388932698874529",
"299475768269001199775499735647832994195",
"181244372587943920516132100894316807453",
"332017236802858246829452018839956202615",
"231998259697245499165510730504102844654",
"223093940676283065771569038798405738741",
"37252762511398032756581321201460685593",
"95959080991199268081408047512902503450",
"3680946299615339993841376544869650058",
"158573102666972448215910537978772244733",
"119640466026782114614037649675453772399",
"55360655578363361157439779597935072385"
]
},
"source": "https://github.com/jasper-software/jasper/commit/4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1a",
"target": {
"file": "src/libjasper/jpc/jpc_qmfb.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-8654-bf200df6",
"digest": {
"length": 1290,
"function_hash": "108930823408400980924474710345560198316"
},
"source": "https://github.com/jasper-software/jasper/commit/4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1a",
"target": {
"file": "src/libjasper/jpc/jpc_qmfb.c",
"function": "jpc_qmfb_split_colres"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:14:12Z"
}
}
],
"modified": "2026-10-20T13:14:12.909610174Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2017:1208",
"https://www.debian.org/security/2017/dsa-3785",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8654",
"https://github.com/mdadams/jasper/commit/4a59cfaf9ab3d48fca4a15c0d2674bf7138e3d1a",
"https://github.com/mdadams/jasper/issues/93",
"https://github.com/mdadams/jasper/issues/94"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_desktop",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
},
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
},
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_aus",
"extracted_events": [
{
"range": [
{
"introduced": "7.3"
},
{
"last_affected": "7.3"
},
{
"introduced": "7.4"
},
{
"last_affected": "7.4"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server_eus",
"extracted_events": [
{
"range": [
{
"introduced": "7.3"
},
{
"last_affected": "7.3"
},
{
"introduced": "7.4"
},
{
"last_affected": "7.4"
},
{
"introduced": "7.5"
},
{
"last_affected": "7.5"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_workstation",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
},
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-8654",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387356,
"published_at": "2018-08-01T16:29:00.337+00:00"
}