Description
The jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer JPEG-2000 library (libjasper) before 1.900 allows remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the heap via malformed image files, as originally demonstrated using imagemagick convert.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ghostscript | 8.61.dfsg.1~svn8187-1.1 | — |
| Debian 13 | ghostscript | 8.61.dfsg.1~svn8187-1.1 | — |
| Debian 12 | ghostscript | 8.61.dfsg.1~svn8187-1.1 | — |
| Debian 5.0 | jasper | 1.900.1-5.1+lenny1 | DSA-2036-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | netpbm +2 | 10.35-6.1.el5_3.1 | RHSA-2009:0012 |
| RHEL 4 | netpbm +2 | 10.25-2.1.el4_7.4 | RHSA-2009:0012 |
Advisories 2
- RHSA-2009:0012 Red Hat Security Advisory: netpbm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2036-1 jasper - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:9397 vdb-entry signature
- 24052 vdb-entry
- USN-501-2 vendor-advisory
- 27319 third-party-advisory
- 36137 vdb-entry
- MDVSA-2009:164 vendor-advisory
- 25287 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=413033
- MDKSA-2007:209 vendor-advisory
- DSA-2036 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=413041
- RHSA-2009:0012 vendor-advisory
- 25703 third-party-advisory
- 26516 third-party-advisory
- MDKSA-2007:129 vendor-advisory
- 27489 third-party-advisory
- MDVSA-2009:142 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=413041%3Bmsg=88
- 39505 third-party-advisory
- MDKSA-2007:208 vendor-advisory
- ADV-2010-0912 vdb-entry
- USN-501-1 vendor-advisory