CVE-2016-8693: Fedoraproject Fedora

High severity, CVSS 7.8. EPSS: 3.3% chance of exploitation in the next 30 days.

Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.

Affected products

• Fedoraproject Fedora: version 23 only
• Jasper Project Jasper: up to and including 1.900.5
• Opensuse Opensuse: version 13.2 only

Published 2017-02-15. Last modified 2026-06-17.