Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 101

Export CSV
CVE-2022-40755

jasper: Reachable assertion in inttobits, jas_image.c

JasPer 3.0.6 allows denial of service via a reachable assertion in the function inttobits in libjasper/base/jas_image.c.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jasper Project
Products
Jasper
CVE-2017-13745

jasper: reachable abort in jpc_dec_process_sot()

There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack by triggering an unexpected jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154.

CVSS 3.0 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Jasper Project
Products
Jasper
CVE-2018-19542

jasper: invalid access in jp2_decode in libjasper/jp2/jp2_dec.c

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading to a denial of service.

CVSS 3.0 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Canonical Debian Jasper Project and 2 more
Products
Ubuntu Linux Debian Linux Jasper and 3 more
CVE-2018-19541

jasper: heap-based buffer over-read of size 8 in jas_image_depalettize in libjasper/base/jas_image.c

An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.

CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed
Vendors
Canonical Debian Jasper Project and 1 more
Products
Ubuntu Linux Debian Linux Jasper and 2 more
CVE-2018-19540

jasper: heap-based buffer overflow of size 1 in jas_icctxtdesc_input in libjasper/base/jas_icc.c

An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer overflow of size 1 in the function jas_icctxtdesc_input in libjasper/base/jas_icc.c.

CVSS 3.0 · 8.8 High EPSS 2.3% KEV · Not listed
Vendors
Debian Jasper Project Suse
Products
Debian Linux Jasper Linux Enterprise Desktop and 1 more
CVE-2018-19539

jasper: access violation in jas_image_readcmpt() in jas_image.c

An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, leading to a denial of service.

CVSS 3.0 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Jasper Project Opensuse and 1 more
Products
Debian Linux Jasper Leap and 2 more
CVE-2018-19139

jasper: memory leak of data allocated in jpc_unk_getparms() after abort in jpc_dec_process_sot()

An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getparms in jpc_cs.c.

CVSS 3.0 · 5.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Debian Jasper Project Redhat
Products
Debian Linux Jasper Fedora
CVE-2008-3522

jasper: possible buffer overflow in jas_stream_printf()

Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.

CVSS 2.0 · 10.0 Critical EPSS 4.5% KEV · Not listed
Vendors
Jasper Project Redhat
Products
Jasper Enterprise Virtualization Rhev Manager
CVE-2008-3520

jasper: multiple integer overflows in jas_alloc calls

Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.

CVSS 2.0 · 9.3 Critical EPSS 3.2% KEV · Not listed
Vendors
Jasper Project Redhat
Products
Jasper Enterprise Linux Rhev Manager
CVE-2008-3521

jasper: temporary file creation race in jas_stream_tmpfile()

Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally reported as a symlink issue, but this was incorrect. NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Jasper Project
Products
Jasper
CVE-2023-51257

jasper: Invalid memory write

An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Jasper Project
Products
Jasper
CVE-2025-8836

JasPer JPEG2000 Encoder jpc_enc.c jpc_floorlog2 assertion

A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Jasper Project
Products
Jasper
CVE-2025-8837

JasPer JPEG2000 File jpc_dec.c jpc_dec_dump use after free

A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Jasper Project
Products
Jasper
CVE-2025-8835

JasPer Image Color Space Conversion jas_image.c jas_image_chclrspc null pointer dereference

A vulnerability was found in JasPer up to 4.2.5. Affected by this vulnerability is the function jas_image_chclrspc of the file src/libjasper/base/jas_image.c of the component Image Color Space Conversion Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Jasper Project
Products
Jasper
CVE-2016-10249

jasper: integer overflow in jas_matrix_create()

Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted image file, which triggers a heap-based buffer overflow.

CVSS 3.0 · 7.8 High EPSS 2.0% KEV · Not listed
Vendors
Jasper Project Redhat
Products
Jasper Enterprise Linux
CVE-2016-10248

jasper: NULL pointer dereference in jpc_tsfb_synthesize()

The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.

CVSS 3.0 · 7.5 High EPSS 4.0% KEV · Not listed
Vendors
Jasper Project Redhat
Products
Jasper Enterprise Linux
CVE-2016-8886

jasper: no upper limit on memory allocations in jas_malloc()

The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers to have unspecified impact via a crafted file, which triggers a memory allocation failure.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed
Vendors
Jasper Project
Products
Jasper