CVE-2015-5203

What it actually does

Double-free in jasper_image_stop_load during JPEG 2000 image processing leads to memory corruption and immediate process crash.

Why it matters to the business

Applications that decode untrusted JPEG 2000 images can be forced to terminate, causing service interruptions and potential loss of image-handling workflows across Linux distributions that ship the vulnerable library.

How an attack unfolds

An attacker supplies a specially crafted JPEG 2000 file that reaches the vulnerable cleanup path twice when the image is loaded; the resulting double-free corrupts heap metadata and crashes the process. No remote code execution has been observed.

How to fix it

Upgrade JasPer to a version containing the fix for the double-free (post-1.900.17 releases or distribution backports). Where an upgrade is not immediately possible, disable JPEG 2000 support or sandbox image-processing components.

How to confirm the fix worked

Confirm the installed JasPer version is newer than 1.900.17 and test that the crafted JPEG 2000 sample no longer crashes the application. Re-run regression tests that exercise JPEG 2000 decode paths.

Typical attack path

1. Attacker crafts a JPEG 2000 file that triggers the double-free condition in jasper_image_stop_load
2. Victim application or library opens the file (local file, email attachment, or web download)
3. Library processes the image and hits the flawed cleanup routine twice
4. Process crashes, resulting in denial of service

How to detect it

Review application and system logs for segmentation faults or abrupt terminations in processes linked to libjasper when JPEG 2000 files are processed. Correlate crash timestamps with file-access events involving .jp2 files.

What your security team should do

• Inventory all systems and packages that depend on JasPer and schedule upgrades
• Apply vendor patches or rebuild from fixed source as soon as packages become available
• Restrict processing of untrusted JPEG 2000 images until patches are deployed
• Monitor for application crashes in image-handling services as a temporary detection signal