CVE-2018-19541
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900...
CVE-2018-19541 is a high vulnerability (CVSS 8.8) in Jasper Project Jasper, published November 26, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.80%, the 86th percentile. Fixed in jasper 1.900.1-debian1-2.4+deb8u5.
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.
- Record
CVE-2018-19541- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.
- Record
CVE-2018-19541- Updated
- 2026-11-02
EUVDEUVD-2018-11230 No score
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.
- Record
EUVD-2018-11230- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2rx7-vfcv-7r3v
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900...
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.
- Record
GHSA-2rx7-vfcv-7r3v- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.
- Record
CVE-2018-19541- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-19541
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.
- Record
UBUNTU-CVE-2018-19541- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVMGASA-2019-0381 No score
Updated jasper packages fix security vulnerabilities
Heap based overflow in jas_icctxtdesc_input (CVE-2018-19540).
Heap based overread in jas_image_depalettize (CVE-2018-19541).
- Record
MGASA-2019-0381- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2279-1 No score
Security update for jasper
This update for jasper fixes the following issues:
Security issues fixed:
- CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input (bsc#1117508).
- CVE-2018-19541: Fix heap based overread in jas_image_depalettize (bsc#1117507).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2279-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2282-1 No score
Security update for jasper
This update for jasper fixes the following issues:
Security issues fixed:
- CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input (bsc#1117508).
- CVE-2018-19541: Fix heap based overread in jas_image_depalettize (bsc#1117507).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:2282-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10869-1 No score
jasper-2.0.33-1.2 on GA media
These are all security issues fixed in the jasper-2.0.33-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10869-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2512-1 No score
Security update for jasper
This update for jasper fixes the following issues:
Security issues fixed:
- CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input (bsc#1117508).
- CVE-2018-19541: Fix heap based overread in jas_image_depalettize (bsc#1117507).
- Record
SUSE-SU-2019:2512-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2513-1 No score
Security update for jasper
This update for jasper fixes the following issues:
Security issues fixed:
- CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input (bsc#1117508).
- CVE-2018-19541: Fix heap based overread in jas_image_depalettize (bsc#1117507).
- CVE-2018-19542: Fixed a denial of service in jp2_decode (bsc#1117505).
- CVE-2018-19539: Fixed a denial of service in jas_image_readcmpt (bsc#1117511).
- CVE-2016-9396: Fixed a denial of service in jpc_cox_getcompparms (bsc#1010783).
- Record
SUSE-SU-2019:2513-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jasperDebian:8 |
before 1.900.1-debian1-2.4+deb8u5, plus listed versions 1.900.1-debian1-2.41.900.1-debian1-2.4+deb8u11.900.1-debian1-2.4+deb8u21.900.1-debian1-2.4+deb8u31.900.1-debian1-2.4+deb8u4 |
1.900.1-debian1-2.4+deb8u5 |
jasperMageia:7 |
before 2.0.14-4.1.mga7 | 2.0.14-4.1.mga7 |
jasperSUSE:Linux Enterprise Module for Basesystem 15 |
before 2.0.14-3.8.1 | 2.0.14-3.8.1 |
jasperSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 2.0.14-3.8.1 | 2.0.14-3.8.1 |
jasperSUSE:Linux Enterprise Module for Desktop Applications 15 |
before 2.0.14-3.8.1 | 2.0.14-3.8.1 |
jasperSUSE:Linux Enterprise Module for Desktop Applications 15 SP1 |
before 2.0.14-3.8.1 | 2.0.14-3.8.1 |
jasperSUSE:Linux Enterprise Desktop 12 SP4 |
before 1.900.14-195.15.1 | 1.900.14-195.15.1 |
jasperSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 1.900.14-195.15.1 | 1.900.14-195.15.1 |
jasperSUSE:Linux Enterprise Server 12 SP4 |
before 1.900.14-195.15.1 | 1.900.14-195.15.1 |
jasperSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 1.900.14-195.15.1 | 1.900.14-195.15.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jasperUbuntu:16.04:LTS |
All versions, plus listed versions 1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.11.900.1-debian1-2.4ubuntu1.21.900.1-debian1-2.4ubuntu1.3 |
None known |
jasperopenSUSE:Leap 15.0 |
before 2.0.14-lp150.2.6.1 | 2.0.14-lp150.2.6.1 |
jasperopenSUSE:Leap 15.1 |
before 2.0.14-lp151.4.3.1 | 2.0.14-lp151.4.3.1 |
jasperopenSUSE:Tumbleweed |
before 2.0.33-1.2 | 2.0.33-1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
lists.debian.org/debian-lts-announce/2019/01/msg00003.html
github.com/mdadams/jasper/issues/182
lists.opensuse.org/opensuse-security-announce/2019-10/msg00023.html
oracle.com/security-alerts/cpuapr2020.html
nvd.nist.gov/vuln/detail/CVE-2018-19541
Show 53 moreShow less
advisories.mageia.org/MGASA-2019-0381.html
bugs.mageia.org/show_bug.cgi?id=25800
suse.com/support/update/announcement/2019/suse-su-20192512-1
bugzilla.suse.com/1117507
ubuntu.com/security/CVE-2018-19541
cve.org/CVERecord?id=CVE-2018-19541