jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jasper-develUpgrade jasper-libs | May 4, 2022 | Jan 27, 2021 |
| Amazon Linux Ami 2 | — | Upgrade jasperUpgrade jasper-debuginfoUpgrade jasper-utilsUpgrade jasper-libsUpgrade jasper-devel | Apr 21, 2023 | Jan 27, 2021 |
| Amazon_linux | — | Upgrade jasper | Apr 21, 2023 | Jan 27, 2021 |
| Centos_linux | — | Upgrade jasper-debugsourceUpgrade jasper-utils-debuginfoUpgrade jasper-debuginfoUpgrade jasper-libs-debuginfoUpgrade jasper-libs | Nov 10, 2021 | Jan 27, 2021 |
| Freebsd | — | Upgrade jasper | Mar 4, 2021 | Mar 3, 2021 |
| Oracle_linux | — | Upgrade jasper-libsUpgrade jasper-devel | Nov 17, 2021 | Jan 27, 2021 |
| Redhat_linux | — | Upgrade jasper-debugsourceUpgrade jasper-develUpgrade jasper-utils-debuginfoUpgrade jasper-libsUpgrade jasper-debuginfoNo solution existsUpgrade jasper-libs-debuginfo | Nov 10, 2021 | Jan 27, 2021 |
| Rocky_linux | — | Upgrade jasper-develUpgrade jasper-libs-debuginfoUpgrade jasper-debuginfoUpgrade jasper-libs | Mar 12, 2024 | Jan 27, 2021 |
| Suse | — | Upgrade libjasper-develUpgrade libjasper1Upgrade libjasper1-32bitUpgrade jasperUpgrade libjasper4-32bitUpgrade libjasper-32bitUpgrade libjasperUpgrade libjasper4 | Feb 17, 2021 | Jan 27, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jan 27, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub