CVE-2020-27828

CVE-2020-27828 (Jasper) is described in connected data as a heap-based buffer overflow in the jpc_enc.c cp_create() path, arising from crafted input. In the CP4S advisory, affected products are Cloud Pak for Security (CP4S) 1.8.1.0, 1.8.0.0, and 1.7.2.0. IBM recommends upgrading to CP4S 1.9.0.0 t...

CVE-2016-9583

CVE-2016-9583 affects the JasPer JPEG-2000 library. The vulnerability is an out-of-bounds heap read in the jpc_pi_nextpcrl() function when processing crafted input, and affects Jasper versions prior to 2.0.6. Potential impact is application crash due to invalid memory access. Remediation: upgrade...

CVE-2021-26926

CVE-2021-26926 affects Jasper (JasPer) up to version 2.0.25, with an out-of-bounds read in jp2_decode that can disclose information or crash the program. Affected: JasPer library; root cause: out-of-bounds read in JP2 decoding path. Impact: information disclosure and potential denial of service v...

CVE-2016-9398

CVE-2016-9398 affects JasPer: the jpc_floorlog2 function in jpc_math.c is vulnerable in versions before 1.900.17, allowing remote attackers to trigger a denial of service (assertion failure) via unspecified vectors. Connected documents confirm the affected component and impact; no remediation det...

CVE-2021-26927

CVE-2021-26927 : Jasper is vulnerable to a denial of service due to a NULL pointer dereference in jp2_decode (jp2_dec.c). The issue affects Jasper up to version before 2.0.25; triggering with a specially crafted file can cause the program to crash. The provided sources describe the vulnerability ...

CVE-2016-8654

CVE-2016-8654 is a JasPer/JPC-codec vulnerability where a heap-buffer overflow occurs due to an undersized QMFB buffer. It affects Jasper versions before 2.0.0. Remediation is to upgrade Jasper to a fixed version (≥2.0.0); various advisories (CentOS CESA-2017:1208, IBM PowerKVM bulletin, Cloud Fo...

CVE-2016-9591

JasPer before 2.0.12 is vulnerable to a use-after-free during decoding of certain JPEG 2000 files, which can crash the host process. CVE-2016-9591 is the primary issue; related CVEs in the same family (e.g., CVE-2016-10249, CVE-2016-10251, CVE-2016-8654, CVE-2016-9560, CVE-2016-1867, CVE-2016-208...

CVE-2016-9560

CVE-2016-9560 describes a stack-based buffer overflow in the JasPer JPEG-2000 library. The overflow occurs in the function jpc_tsfb_getbands2 inside jpc_tsfb.c and affects JasPer before version 1.900.30 . An attacker could trigger the overflow by supplying a crafted image, with the impact describ...

CVE-2021-3443

CVE-2021-3443 describes a NULL pointer dereference in Jasper’s JP2 image format decoder. A crafted JP2 file could cause an application using the Jasper library to crash. The description indicates the flaw exists in Jasper versions prior to 2.0.27. There is no explicit exploitation status, affecte...

CVE-2016-9388

CVE-2016-9388 : The ras_getcmap function in ras_dec.c of the Jasper JPEG 2000 library (before 1.900.14) enables a remote attacker to trigger a denial of service via a crafted image file that causes an assertion failure. The connected documents confirm this vulnerability within JasPer and referenc...

CVE-2016-9600

CVE-2016-9600 : JasPer before version 2.0.10 is vulnerable to a null pointer dereference in the decoded creation of JPEG 2000 image files, which can cause an application using JasPer to crash. The connected documents confirm the same issue across multiple advisories and Nessus plugins, indicating...

CVE-2021-3467

CVE-2021-3467 is a NULL pointer dereference in Jasper’s JP2 image format decoder when handling component references in the JP2 CDEF box. A crafted JP2 image could cause an application using the Jasper library to crash. Affected: Jasper versions before 2.0.26 (per the description). Impact: crash r...

CVE-2015-8751

CVE-2015-8751 affects JasPer/JasPer’s jas_matrix_create function. The connected sources confirm an integer overflow in this path, triggered while processing certain JPEG 2000 images, related to memory allocation. Reported impact includes potential remote code execution or denial of service, as do...