CVE-2021-3443
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled...
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
- Record
CVE-2021-3443- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
- Record
CVE-2021-3443- Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2021-26769 No score
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
- Record
EUVD-2021-26769- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f675-2h8m-hfrq No score
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled...
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
- Record
GHSA-f675-2h8m-hfrq- Weakness
- CWE-476
- Updated
- 2026-11-02
OSVAZL-6494
CVE-2021-3443 affecting package jasper for versions less than 2.0.32-2
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
- Record
AZL-6494- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
- Record
CVE-2021-3443- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2021-3443
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
- Record
UBUNTU-CVE-2021-3443- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1778218633 No score
jasper: Fix of 3 CVEs
- Add Amazon Linux 2 ELS support (mirrors centos7els branch with .amzn2 dist via / leapfrog over stock 1.900.1-33.amzn2.0.1)
- Import CVE-2020-27828 patch from amzn2 stock SRPM (out-of-bounds write in jpc encoder; jasper-2.0.14-CVE-2020-27828.patch)
- Import CVE-2021-3443 patch from amzn2 stock SRPM (NULL pointer dereference in JP2 component reference handling)
- Import CVE-2021-3467 patch from amzn2 stock SRPM (NULL pointer dereference in CDEF box channel reference handling)
- Record
CLSA-2026-1778218633- Updated
- 2026-11-02
OSVCLSA-2026-1778227041 No score
jasper: Fix of 3 CVEs
- Add Amazon Linux 2 ELS support (mirrors centos7els branch with .amzn2 dist via / leapfrog over stock 1.900.1-33.amzn2.0.1)
- Import CVE-2020-27828 patch from amzn2 stock SRPM (out-of-bounds write in jpc encoder; jasper-2.0.14-CVE-2020-27828.patch)
- Import CVE-2021-3443 patch from amzn2 stock SRPM (NULL pointer dereference in JP2 component reference handling)
- Import CVE-2021-3467 patch from amzn2 stock SRPM (NULL pointer dereference in CDEF box channel reference handling)
- Record
CLSA-2026-1778227041- Updated
- 2026-11-02
OSVCLSA-2026-1792442076 No score
jasper: Fix of 4 CVEs
- Add Amazon Linux 2 ELS support (mirrors centos7els branch with .amzn2 dist via / leapfrog over stock 1.900.1-33.amzn2.0.1)
- Import CVE-2020-27828 patch from amzn2 stock SRPM (out-of-bounds write in jpc encoder; jasper-2.0.14-CVE-2020-27828.patch)
- Import CVE-2021-3443 patch from amzn2 stock SRPM (NULL pointer dereference in JP2 component reference handling)
- Import CVE-2021-3467 patch from amzn2 stock SRPM (NULL pointer dereference in CDEF box channel reference handling)
- Record
CLSA-2026-1792442076- Updated
- 2026-11-02
OSVMGASA-2021-0249 No score
Updated jasper packages fix security vulnerabilities
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened (CVE-2021-3443).
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened (CVE-2021-3467).
- Record
MGASA-2021-0249- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13389-1 No score
jasper-4.0.0-2.1 on GA media
These are all security issues fixed in the jasper-4.0.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13389-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1475-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2021-3467: Fixed NULL pointer deref in jp2_decode() (bsc#1184757).
- CVE-2021-3443: Fixed NULL pointer deref in jp2_decode() (bsc#1184798).
- CVE-2021-26927: Fixed NULL pointer deref in jp2_decode() (bsc#1182104).
- CVE-2021-26926: Fixed an out of bounds read in jp2_decode() (bsc#1182105).
- Record
SUSE-SU-2022:1475-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1479-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2021-3467: Fixed NULL pointer deref in jp2_decode() (bsc#1184757).
- CVE-2021-3443: Fixed NULL pointer deref in jp2_decode() (bsc#1184798).
- CVE-2021-26927: Fixed NULL pointer deref in jp2_decode() (bsc#1182104).
- CVE-2021-26926: Fixed an out of bounds read in jp2_decode() (bsc#1182105).
- Record
SUSE-SU-2022:1479-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jasperAzure Linux:2 |
before 2.0.32-2 | 2.0.32-2 |
jasperTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
jasper-develTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
jasper-libsTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
jasper-utilsTuxCare:OracleLinux:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
jasperTuxCare:CentOS:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
jasper-develTuxCare:CentOS:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
jasper-libsTuxCare:CentOS:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
jasper-utilsTuxCare:CentOS:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
jasperTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
Show 16 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jasper-develTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
jasper-libsTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
jasper-utilsTuxCare:RHEL:7 From an advisory covering 3 CVEs |
before 1.900.1-33.el7.tuxcare.els6 | 1.900.1-33.el7.tuxcare.els6 |
jasperMageia:7 From an advisory covering 2 CVEs |
before 2.0.27-1.mga7 | 2.0.27-1.mga7 |
jasperMageia:8 From an advisory covering 2 CVEs |
before 2.0.27-1.mga8 | 2.0.27-1.mga8 |
mingw-jasperMageia:8 From an advisory covering 2 CVEs |
before 2.0.27-1.mga8 | 2.0.27-1.mga8 |
jasperSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 4 CVEs |
before 1.900.14-195.31.1 | 1.900.14-195.31.1 |
jasperSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 4 CVEs |
before 1.900.14-195.31.1 | 1.900.14-195.31.1 |
jasperSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 4 CVEs |
before 1.900.14-195.31.1 | 1.900.14-195.31.1 |
jasperSUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 4 CVEs |
before 2.0.14-150000.3.25.1 | 2.0.14-150000.3.25.1 |
jasperSUSE:Linux Enterprise Module for Desktop Applications 15 SP3 From an advisory covering 4 CVEs |
before 2.0.14-150000.3.25.1 | 2.0.14-150000.3.25.1 |
jasperSUSE:Linux Enterprise Real Time 15 SP2 From an advisory covering 4 CVEs |
before 2.0.14-150000.3.25.1 | 2.0.14-150000.3.25.1 |
jasperopenSUSE:Leap 15.3 From an advisory covering 4 CVEs |
before 2.0.14-150000.3.25.1 | 2.0.14-150000.3.25.1 |
jasperopenSUSE:Leap 15.4 From an advisory covering 4 CVEs |
before 2.0.14-150000.3.25.1 | 2.0.14-150000.3.25.1 |
jasperUbuntu:16.04:LTS |
All versions, plus listed versions 1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.11.900.1-debian1-2.4ubuntu1.21.900.1-debian1-2.4ubuntu1.3 |
None known |
jasperopenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 4.0.0-2.1 | 4.0.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3443 is a medium vulnerability (CVSS 5.5) in Jasper Project Jasper, published March 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.76%, the 55th percentile. Fixed in jasper 2.0.32-2.
References
bugzilla.redhat.com/show_bug.cgi?id=1939233
nvd.nist.gov/vuln/detail/CVE-2021-3443
github.com/advisories/GHSA-f675-2h8m-hfrq
errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1778218633.html
Show 22 moreShow less
advisories.mageia.org/MGASA-2021-0249.html
bugs.mageia.org/show_bug.cgi?id=29017
lists.fedoraproject.org/archives/list/[email protected]/thread/KWAIUFNIUCGS2IMGGDTWZIUIY7BNLGKF
suse.com/support/update/announcement/2022/suse-su-20221475-1
bugzilla.suse.com/1182104
ubuntu.com/security/CVE-2021-3443
cve.org/CVERecord?id=CVE-2021-3443