jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jasper-libsUpgrade jasper-devel | May 4, 2022 | Jan 27, 2021 |
| Amazon Linux Ami 2 | — | Upgrade jasper-debuginfoUpgrade jasperUpgrade jasper-libsUpgrade jasper-utilsUpgrade jasper-devel | Apr 21, 2023 | Jan 27, 2021 |
| Amazon_linux | — | Upgrade jasper | Apr 21, 2023 | Jan 27, 2021 |
| Centos_linux | — | Upgrade jasper-libsUpgrade jasper-libs-debuginfoUpgrade jasper-debugsourceUpgrade jasper-debuginfoUpgrade jasper-utils-debuginfo | Nov 10, 2021 | Jan 27, 2021 |
| Freebsd | — | Upgrade jasper | Mar 4, 2021 | Mar 3, 2021 |
| Oracle_linux | — | Upgrade jasper-libsUpgrade jasper-devel | Nov 17, 2021 | Jan 27, 2021 |
| Redhat_linux | — | Upgrade jasper-debugsourceUpgrade jasper-develUpgrade jasper-utils-debuginfoUpgrade jasper-debuginfoNo solution existsUpgrade jasper-libs-debuginfoUpgrade jasper-libs | Nov 10, 2021 | Jan 27, 2021 |
| Rocky_linux | — | Upgrade jasper-develUpgrade jasper-libs-debuginfoUpgrade jasper-debuginfoUpgrade jasper-libs | Mar 12, 2024 | Jan 27, 2021 |
| Suse | — | Upgrade libjasper-32bitUpgrade libjasperUpgrade libjasper4Upgrade libjasper4-32bitUpgrade libjasper-develUpgrade libjasper1Upgrade jasperUpgrade libjasper1-32bit | Feb 17, 2021 | Jan 27, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jan 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub