JasPer Null Pointer Dereference Vulnerability in Image Color Space Conversion

A null pointer dereference vulnerability has been identified in JasPer versions through 4.2.5. The issue arises in the image color space conversion function 'jas_image_chclrspc' within 'src/libjasper/base/jas_image.c'. When the function processes malformed image files, it can receive a null pointer instead of a valid image object. This leads to an immediate segmentation fault, causing the application to crash. The vulnerability can be exploited locally, and a proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability leads to a segmentation fault, causing the application to crash.

Reproduction

The vulnerability can be reproduced by using the JasPer command-line tool to process a malformed image file with the BMP output format and the color space conversion option. This can be done by executing the command './jasper --output-format bmp --cmptno ppm -S --input POC_jasper_null_pointer_dereference', where 'POC_jasper_null_pointer_dereference' is the crafted image file that triggers the vulnerability.

Remediation

Users are advised to update to JasPer version 4.2.8, where this vulnerability has been fixed.