Red Hat Security Advisory

RHSA-2021:4235

jasper security update

Released 2021-11-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 8) jasper-devel-2.0.14-5.el8
Red Hat Enterprise Linux AppStream (v. 8) jasper-2.0.14-5.el8, jasper-libs-2.0.14-5.el8

Fixes 4 records

TI-2020-16899 CVE-2020-27828 · GHSA-x4rf-6444-7fh8

Improper input validation in jasper

LOW 37

There's a flaw in jasper's jpc encoder in versions prior to 2.0.23.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01388 Published 2020-12-11 Partial fix · 2.0.23 CWE-20

TI-2021-08531 CVE-2021-26926 · GHSA-xx8c-rpq7-pg6p

Out-of-bounds read in jasper

LOW 34

A flaw was found in jasper before 2.0.25.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.01197 Published 2021-02-23 Partial fix CWE-125

TI-2021-08532 CVE-2021-26927 · GHSA-9768-8435-chr8

NULL pointer dereference in jasper

LOW 27

A flaw was found in jasper before 2.0.25.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.0109 Published 2021-02-23 Partial fix · 2.0.25 CWE-476

TI-2021-02293 CVE-2021-3272 · GHSA-g2j5-mv4m-h6rc

jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer…

LOW 27

jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.0112 Published 2021-01-27 Partial fix CWE-125