Description
The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ghostscript | 8.64~dfsg-2 | — |
| Debian 13 | ghostscript | 8.64~dfsg-2 | — |
| Debian 12 | ghostscript | 8.64~dfsg-2 | — |
| Debian 6.0 | jasper | 1.900.1-7+squeeze1 | DSA-2371-1 |
| Debian 5.0 | jasper | 1.900.1-5.1+lenny2 | DSA-2371-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | jasper +3 | 1.900.1-15.el6_1.1 | RHSA-2011:1807 |
| RHEL 5 | netpbm +2 | 10.35.58-8.el5_7.3 | RHSA-2011:1811 |
| RHEL 4 | netpbm +2 | 10.35.58-8.el4 | RHSA-2011:1811 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 3 | rhevm-spice-client +4 | 3.5-3.el6 | RHSA-2015:0698 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | jasper | 1.900.14-3.1 | openSUSE-SU-2024:10281-1 |
Advisories 5
- RHSA-2015:0698 Red Hat Security Advisory: rhevm-spice-client security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:1807 Red Hat Security Advisory: jasper security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2011:1811 Red Hat Security Advisory: netpbm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2371-1 jasper - buffer overflows Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10281-1 jasper-1.900.14-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2011:1811 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=747726
- 47306 third-party-advisory
- USN-1315-1 vendor-advisory
- openSUSE-SU-2011:1317 vendor-advisory
- DSA-2371 vendor-advisory
- FEDORA-2011-16966 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21660640
- FEDORA-2011-16955 vendor-advisory
- 47353 third-party-advisory
- RHSA-2011:1807 vendor-advisory
- 77596 vdb-entry
- http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html
- RHSA-2015:0698 vendor-advisory
- jasper-jpccrggetparms-bo(71701) vdb-entry
- VU#887409 third-party-advisory
- 50992 vdb-entry
- 47193 third-party-advisory
- SSA:2015-302-02 vendor-advisory