Every CVE Search/ Get API key

CVE-2018-18873

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function...

5.5 MediumFix available

CVE-2018-18873 is a medium vulnerability (CVSS 5.5) in Jasper Project Jasper, published October 31, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 72nd percentile. Fixed in jasper 1.900.1-debian1-2.4+deb8u5.

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.37%Down 0.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.5

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.

Record
CVE-2018-18873
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.

Record
CVE-2018-18873
Updated
2026-11-02
EUVDEUVD-2018-10584 No score

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.

Record
EUVD-2018-10584
Updated
2026-11-03
GitHub AdvisoriesGHSA-q86v-48q4-7hr6 5.5

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function...

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.

Record
GHSA-q86v-48q4-7hr6
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSV 5.5

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.

Record
CVE-2018-18873
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-18873 5.5

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c.

Record
UBUNTU-CVE-2018-18873
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVMGASA-2020-0337 No score

Updated jasper packages fix security vulnerabilities

The jas_matrix_bindsub function in jas_seq.c in JasPer 2.0.10 allows remote attackers to cause a denial of service (invalid read) via a crafted image (CVE-2017-6851).

Heap-based buffer overflow in the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer 2.0.10 allows remote attackers to have unspecified impact via a crafted image (CVE-2017-6852).

JasPer 2.0.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, related to the jp2_decode function in libjasper/jp2/jp2_dec.c (CVE-2017-9782).

There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack by triggering an unexpected jpc_ppmstabtostreams return value (CVE-2017-13745).

There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer 2.0.12 that will lead to a remote denial of service attack (CVE-2017-13746).

There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote denial of service attack (CVE-2017-13748).

There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack (CVE-2017-13749).

There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer 2.0.12 that will lead to a remote denial of service attack (CVE-2017-13750).

There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack (CVE-2017-13751).

JasPer 2.0.13 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, related to the jas_image_ishomosamp function in libjasper/base/jas_image.c (CVE-2017-14132).

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c (CVE-2018-9252).

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c (CVE-2018-18873).

An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getparms in jpc_cs.c (CVE-2018-19139).

An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c (CVE-2018-19543).

jp2_encode in jp2/jp2_enc.c in JasPer 2.0.14 has a heap-based buffer over-read (CVE-2018-20570).

JasPer 2.0.14 has a memory leak in base/jas_malloc.c in libjasper.a when "--output-format jp2" is used (CVE-2018-20622).

Record
MGASA-2020-0337
Updated
2026-11-02
OSVopenSUSE-SU-2020:1517-1 No score

Security update for jasper

This update for jasper fixes the following issues:

  • CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
  • CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
  • CVE-2017-5499: Validate component depth bit (bsc#1020451).
  • CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
  • CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
  • CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
  • CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
  • CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
  • CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
  • CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
  • CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
  • CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
  • CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1517-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1523-1 No score

Security update for jasper

This update for jasper fixes the following issues:

  • CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
  • CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
  • CVE-2017-5499: Validate component depth bit (bsc#1020451).
  • CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
  • CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
  • CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
  • CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
  • CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
  • CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
  • CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
  • CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
  • CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
  • CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1523-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10869-1 No score

jasper-2.0.33-1.2 on GA media

These are all security issues fixed in the jasper-2.0.33-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10869-1
Updated
2026-11-02
OSVSUSE-SU-2020:2689-1 No score

Security update for jasper

This update for jasper fixes the following issues:

  • CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
  • CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
  • CVE-2017-5499: Validate component depth bit (bsc#1020451).
  • CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
  • CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
  • CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
  • CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
  • CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
  • CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
  • CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
  • CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
  • CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
  • CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
Record
SUSE-SU-2020:2689-1
Updated
2026-11-02
OSVSUSE-SU-2020:2690-1 No score

Security update for jasper

This update for jasper fixes the following issues:

  • CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).
  • CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).
  • CVE-2016-9397: Fix assert in jpc_dequantize (bsc#1010786).
  • CVE-2016-9557: Fix signed integer overflow (bsc#1011829).
  • CVE-2017-5499: Validate component depth bit (bsc#1020451).
  • CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).
  • CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).
  • CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).
  • CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).
  • CVE-2018-9154: Fixed a potential denial of service in jpc_dec_process_sot() (bsc#1092115).
  • CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).
  • CVE-2018-18873: Fix null pointer deref in ras_putdatastd (bsc#1114498).
  • CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).
  • CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).
  • CVE-2018-20570: Fix heap based buffer over-read in jp2_encode (bsc#1120807).
  • CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).
Record
SUSE-SU-2020:2690-1
Updated
2026-11-02
OSVUSN-4688-1 No score

jasper vulnerabilities

It was discovered that Jasper incorrectly certain files. An attacker could possibly use this issue to cause a crash. (CVE-2018-18873)

It was discovered that Jasper incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-19542)

It was discovered that Jasper incorrectly handled certain JPC encoders. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-27828)

It was discovered that Jasper incorrectly handled certain images. An attacker could possibly use this issue to expose sensitive information or cause a crash. (CVE-2017-9782)

Record
USN-4688-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jasper
Debian:8
 before 1.900.1-debian1-2.4+deb8u5, plus listed versions
1.900.1-debian1-2.41.900.1-debian1-2.4+deb8u11.900.1-debian1-2.4+deb8u21.900.1-debian1-2.4+deb8u31.900.1-debian1-2.4+deb8u4
1.900.1-debian1-2.4+deb8u5
jasper
Mageia:7
 before 2.0.19-1.mga7
2.0.19-1.mga7
jasper
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 2.0.14-3.16.1
2.0.14-3.16.1
jasper
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 2.0.14-3.16.1
2.0.14-3.16.1
jasper
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
 before 2.0.14-3.16.1
2.0.14-3.16.1
jasper
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
 before 2.0.14-3.16.1
2.0.14-3.16.1
jasper
SUSE:Linux Enterprise Module for Package Hub 15 SP1
 before 2.0.14-3.16.1
2.0.14-3.16.1
jasper
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.900.14-195.22.1
1.900.14-195.22.1
jasper
SUSE:Linux Enterprise Server 12 SP5
 before 1.900.14-195.22.1
1.900.14-195.22.1
jasper
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 1.900.14-195.22.1
1.900.14-195.22.1
Show 4 moreShow less
Affected packages
PackageAffectedFixed
jasper
Ubuntu:16.04:LTS
 before 1.900.1-debian1-2.4ubuntu1.3, plus listed versions
1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.11.900.1-debian1-2.4ubuntu1.2
1.900.1-debian1-2.4ubuntu1.3
jasper
openSUSE:Leap 15.1
 before 2.0.14-lp151.4.9.1
2.0.14-lp151.4.9.1
jasper
openSUSE:Leap 15.2
 before 2.0.14-lp152.7.3.1
2.0.14-lp152.7.3.1
jasper
openSUSE:Tumbleweed
 before 2.0.33-1.2
2.0.33-1.2

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 75 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open