jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jasper-develUpgrade jasper-libs | May 4, 2022 | Jan 27, 2021 |
| Amazon Linux Ami 2 | — | Upgrade jasper-libsUpgrade jasper-develUpgrade jasper-utilsUpgrade jasperUpgrade jasper-debuginfo | Apr 21, 2023 | Jan 27, 2021 |
| Amazon_linux | — | Upgrade jasper | Apr 21, 2023 | Jan 27, 2021 |
| Centos_linux | — | Upgrade jasper-libs-debuginfoUpgrade jasper-libsUpgrade jasper-debugsourceUpgrade jasper-debuginfoUpgrade jasper-utils-debuginfo | Nov 10, 2021 | Jan 27, 2021 |
| Freebsd | — | Upgrade jasper | Mar 4, 2021 | Mar 3, 2021 |
| Oracle_linux | — | Upgrade jasper-libsUpgrade jasper-devel | Nov 17, 2021 | Jan 27, 2021 |
| Redhat_linux | — | Upgrade jasper-develUpgrade jasper-debugsourceUpgrade jasper-utils-debuginfoNo solution existsUpgrade jasper-debuginfoUpgrade jasper-libsUpgrade jasper-libs-debuginfo | Nov 10, 2021 | Jan 27, 2021 |
| Rocky_linux | — | Upgrade jasper-libs-debuginfoUpgrade jasper-develUpgrade jasper-libsUpgrade jasper-debuginfo | Mar 12, 2024 | Jan 27, 2021 |
| Suse | — | Upgrade libjasper-32bitUpgrade libjasper4Upgrade libjasperUpgrade libjasper4-32bitUpgrade libjasper-develUpgrade libjasper1Upgrade libjasper1-32bitUpgrade jasper | Feb 17, 2021 | Jan 27, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jan 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub