rpm package
suse/jasper&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2
pkg:rpm/suse/jasper&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2
Vulnerabilities (39)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-3272 | — | < 1.900.14-195.25.1 | 1.900.14-195.25.1 | Jan 27, 2021 | jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components. | ||
| CVE-2020-27828 | — | < 1.900.14-195.25.1 | 1.900.14-195.25.1 | Dec 11, 2020 | There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability. | ||
| CVE-2016-9583 | — | < 1.900.14-194.1 | 1.900.14-194.1 | Aug 1, 2018 | An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input. | ||
| CVE-2016-8654 | — | < 1.900.14-184.1 | 1.900.14-184.1 | Aug 1, 2018 | A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected. | ||
| CVE-2016-9600 | — | < 1.900.14-194.1 | 1.900.14-194.1 | Mar 12, 2018 | JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. | ||
| CVE-2016-9591 | — | < 1.900.14-184.1 | 1.900.14-184.1 | Mar 9, 2018 | JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer. | ||
| CVE-2015-5203 | Med | 5.5 | < 1.900.14-181.1 | 1.900.14-181.1 | Aug 2, 2017 | Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file. | |
| CVE-2015-5221 | Med | 5.5 | < 1.900.14-181.1 | 1.900.14-181.1 | Jul 25, 2017 | Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file. | |
| CVE-2017-1000050 | Hig | 7.5 | < 1.900.14-195.3.1 | 1.900.14-195.3.1 | Jul 17, 2017 | JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service. | |
| CVE-2016-8884 | Med | 5.5 | < 1.900.14-181.1 | 1.900.14-181.1 | Mar 28, 2017 | The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016 | |
| CVE-2016-9398 | Hig | 7.5 | < 1.900.14-184.1 | 1.900.14-184.1 | Mar 23, 2017 | The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors. | |
| CVE-2016-9395 | Med | 5.5 | < 1.900.14-184.1 | 1.900.14-184.1 | Mar 23, 2017 | The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. | |
| CVE-2016-9394 | Med | 5.5 | < 1.900.14-195.3.1 | 1.900.14-195.3.1 | Mar 23, 2017 | The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. | |
| CVE-2016-9393 | Med | 5.5 | < 1.900.14-195.3.1 | 1.900.14-195.3.1 | Mar 23, 2017 | The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. | |
| CVE-2016-9392 | Med | 5.5 | < 1.900.14-195.3.1 | 1.900.14-195.3.1 | Mar 23, 2017 | The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. | |
| CVE-2016-9391 | Hig | 7.5 | < 1.900.14-195.3.1 | 1.900.14-195.3.1 | Mar 23, 2017 | The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer. | |
| CVE-2016-9390 | Med | 5.5 | < 1.900.14-195.3.1 | 1.900.14-195.3.1 | Mar 23, 2017 | The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. | |
| CVE-2016-9389 | Hig | 7.5 | < 1.900.14-195.3.1 | 1.900.14-195.3.1 | Mar 23, 2017 | The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure). | |
| CVE-2016-9388 | Med | 5.5 | < 1.900.14-195.3.1 | 1.900.14-195.3.1 | Mar 23, 2017 | The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. | |
| CVE-2016-9262 | Med | 5.5 | < 1.900.14-195.3.1 | 1.900.14-195.3.1 | Mar 23, 2017 | Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities. |
- CVE-2021-3272Jan 27, 2021affected < 1.900.14-195.25.1fixed 1.900.14-195.25.1
jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.
- CVE-2020-27828Dec 11, 2020affected < 1.900.14-195.25.1fixed 1.900.14-195.25.1
There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.
- CVE-2016-9583Aug 1, 2018affected < 1.900.14-194.1fixed 1.900.14-194.1
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.
- CVE-2016-8654Aug 1, 2018affected < 1.900.14-184.1fixed 1.900.14-184.1
A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are affected.
- CVE-2016-9600Mar 12, 2018affected < 1.900.14-194.1fixed 1.900.14-194.1
JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
- CVE-2016-9591Mar 9, 2018affected < 1.900.14-184.1fixed 1.900.14-184.1
JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
- affected < 1.900.14-195.3.1fixed 1.900.14-195.3.1
JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.
- affected < 1.900.14-181.1fixed 1.900.14-181.1
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016
- affected < 1.900.14-184.1fixed 1.900.14-184.1
The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.
- affected < 1.900.14-184.1fixed 1.900.14-184.1
The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
- affected < 1.900.14-195.3.1fixed 1.900.14-195.3.1
The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
- affected < 1.900.14-195.3.1fixed 1.900.14-195.3.1
The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
- affected < 1.900.14-195.3.1fixed 1.900.14-195.3.1
The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
- affected < 1.900.14-195.3.1fixed 1.900.14-195.3.1
The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer.
- affected < 1.900.14-195.3.1fixed 1.900.14-195.3.1
The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.
- affected < 1.900.14-195.3.1fixed 1.900.14-195.3.1
The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure).
- affected < 1.900.14-195.3.1fixed 1.900.14-195.3.1
The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file.
- affected < 1.900.14-195.3.1fixed 1.900.14-195.3.1
Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities.
Page 1 of 2