CVE-2022-30929

CVE-2022-30929 CVE-2022-30929 POC Suggested description Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper. Vulnerability Type Insecure Permissions Vendor of Product github;gitee Affected Product Code Base...

CVE-2026-74049 Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

Execution After Redirect EAR vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1.60, from 9.0.0.M1 through 9.0.122. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0...

CVE-2026-74049

Apache Tomcat is vulnerable to an Execution After Redirect (EAR) vulnerability (CWE-698) due to the Jasper JSTL plug-in implementation omitting the page abort (SKIP_PAGE) . This affects versions 11.0.0-M1 through 11.0.26 , 10.1.0-M1 through 10.1.60 , and 9.0.0.M1 through 9.0.122 . End-of-life ve...

tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

A flaw was found in Apache Tomcat. The application fails to halt execution after sending an HTTP redirect response, resulting in an Execution After Redirect EAR condition. A remote attacker could exploit this flaw by ignoring the redirect instruction to access responses generated after the...

tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)

A flaw was found in Apache Tomcat. The application fails to halt execution after sending an HTTP redirect response, resulting in an Execution After Redirect EAR condition. A remote attacker could exploit this flaw by ignoring the redirect instruction to access responses generated after the...

Rocky Linux 9.6 [CIQ] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils Multiple Vulnerabilities (ciqsa-2026_1632)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20261632 advisory. This advisory aggregates security fixes for the jasper SRPM in CIQ LTS 9.6. It addresses 37 CVEs: CVE-2008-3522, CVE-2016-1577, CVE-2014-9029,...

Fixed in Apache Tomcat 10.1.61

Important: HTTP/2 request/response mix-up after error during async processing CVE-2026-101356 Incorrect object recycling and re-use affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This was fixed with commit 6c7da608. This issue was...

CentOS Linux 7 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils (CENTOS7:CLSA-2025:1759864646)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1759864646 advisory. - A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpcdecdump of the file src/libjasper/jpc/jpcdec.c of the...

AlmaLinux 9.2 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils (ALMALINUX9.2:CLSA-2025:1746187690)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1746187690 advisory. - An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code. CVE-2023-5125...

CentOS Linux 7 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils (CENTOS7:CLSA-2024:1723146304)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1723146304 advisory. - An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code. CVE-2023-51257 No...

CentOS Linux 7 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils Multiple Vulnerabilities (CENTOS7:CLSA-2026:1778227041)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1778227041 advisory. - A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image forma...

Rocky Linux 8 [CIQ] Security Update: jasper-debuginfo / jasper-devel / jasper-libs / etc Multiple Vulnerabilities (crlsa-2021_4235)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214235 advisory. jasper: Heap-based buffer overflow in cpcreate in jpcenc.c CVE-2020-27828 jasper: Heap-based buffer over-read in jp2decode in jp2dec.c CVE-2021-3272 jasper...

AlmaLinux 9.2 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1760019942)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760019942 advisory. - A vulnerability was found in JasPer up to 4.2.5. Affected by this vulnerability is the function jasimagechclrspc of the file...

OESA-2026-4180 jasper security update

The JasPer Project is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard. Security Fixes: A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpcdecdump of the file...

OESA-2026-4181 jasper security update

The JasPer Project is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard. Security Fixes: A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpcdecdump of the file...

OESA-2026-4179 jasper security update

The JasPer Project is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 standard. Security Fixes: A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpcdecdump of the file...

AlmaLinux 9.6 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1765378381)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1765378381 advisory. - An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code...

CentOS Linux 7 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils (CENTOS7:CLSA-2026:1776849467)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1776849467 advisory. - A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2decode function whic may lead to disclosure of informatio...

AlmaLinux 9.2 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils (ALMALINUX9.2:CLSA-2025:1759498325)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1759498325 advisory. - A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpcdecdump of the file src/libjasper/jpc/jpcdec.c of the...

Rocky Linux 9.6 [TuxCare] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2025:1765378381)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1765378381 advisory. - An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code...