Jasper Project vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-31744 In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a deHigh 7.5 · Apr 19, 2024
• CVE-2023-51257 An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code.High 7.8 · Jan 15, 2024
• CVE-2022-2963 A vulnerability found in jasper.High 7.5 · Oct 14, 2022
• CVE-2021-26926 A flaw was found in jasper before 2.0.25.High 7.1 · Feb 23, 2021
• CVE-2020-27828 There's a flaw in jasper's jpc encoder in versions prior to 2.0.23.High 7.8 · Dec 10, 2020
• CVE-2015-8751 Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, relateHigh 8.8 · Feb 17, 2020
• CVE-2018-19543 An issue was discovered in JasPer 2.0.14.High 7.8 · Nov 25, 2018
• CVE-2018-19541 An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20High 8.8 · Nov 25, 2018
• CVE-2018-19540 An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20High 8.8 · Nov 25, 2018
• CVE-2018-9154 There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack bHigh 7.5 · May 4, 2018
• CVE-2017-14229 There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of Jasper 2.0.13.High 7.5 · Sep 9, 2017
• CVE-2017-13752 There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.High 7.5 · Aug 29, 2017
• CVE-2017-13751 There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.High 7.5 · Aug 29, 2017
• CVE-2017-13750 There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer 2.0.12 that will lead to a remote denial of service aHigh 7.5 · Aug 29, 2017
• CVE-2017-13749 There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack.High 7.5 · Aug 29, 2017
• CVE-2017-13748 There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote denial of service attacHigh 7.5 · Aug 29, 2017
• CVE-2017-13747 There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12 that will lead to a remote denial of service attack.High 7.5 · Aug 29, 2017
• CVE-2017-13746 There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer 2.0.12 that will lead to a remote denial of service aHigh 7.5 · Aug 29, 2017
• CVE-2017-13745 There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attackHigh 7.5 · Aug 29, 2017
• CVE-2017-1000050 JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component reHigh 7.5 · Jul 17, 2017
• CVE-2016-9399 The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.High 7.5 · Mar 23, 2017
• CVE-2016-9398 The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectHigh 7.5 · Mar 23, 2017
• CVE-2016-9397 The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.High 7.5 · Mar 23, 2017
• CVE-2016-9396 The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) viHigh 7.5 · Mar 23, 2017
• CVE-2016-9391 The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very largeHigh 7.5 · Mar 23, 2017