CVE-2024-31744
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an...
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
- Record
CVE-2024-31744- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
EUVDEUVD-2024-29617
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
- Record
EUVD-2024-29617- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4pvq-mcwh-v9jc
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an...
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
- Record
GHSA-4pvq-mcwh-v9jc- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
NVD
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
- Record
CVE-2024-31744- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSV
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
- Record
CVE-2024-31744- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-31744
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
- Record
UBUNTU-CVE-2024-31744- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVAZL-40000 No score
CVE-2024-31744 affecting package jasper for versions less than 4.2.1-2
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
- Record
AZL-40000- Updated
- 2026-11-05
OSVMGASA-2024-0144 No score
Updated jasper packages fix security vulnerability
CVE-2024-31744: Fixed denial of service through assertion failure in jpc_streamlist_remove()
- Record
MGASA-2024-0144- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13878-1 No score
jasper-4.2.3-2.1 on GA media
These are all security issues fixed in the jasper-4.2.3-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13878-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1396-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2024-31744: Fixed denial of service through assertion failure in jpc_streamlist_remove() (bsc#1223155).
- Record
SUSE-SU-2024:1396-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1464-1 No score
Security update for jasper
This update for jasper fixes the following issues:
- CVE-2024-31744: Fixed denial of service through assertion failure in jpc_streamlist_remove() (bsc#1223155).
- Record
SUSE-SU-2024:1464-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jasperAzure Linux:3 |
before 4.2.1-2 | 4.2.1-2 |
jasperMageia:9 |
before 3.0.6-1.1.mga9 | 3.0.6-1.1.mga9 |
jasperSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 1.900.14-195.40.1 | 1.900.14-195.40.1 |
jasperSUSE:Linux Enterprise Server 12 SP5 |
before 1.900.14-195.40.1 | 1.900.14-195.40.1 |
jasperSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.900.14-195.40.1 | 1.900.14-195.40.1 |
jasperSUSE:Linux Enterprise Module for Basesystem 15 SP5 |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jasperSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Manager Proxy 4.3 |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Manager Server 4.3 |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperSUSE:Enterprise Storage 7.1 |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperopenSUSE:Leap 15.5 |
before 2.0.14-150000.3.34.1 | 2.0.14-150000.3.34.1 |
jasperUbuntu:16.04:LTS |
All versions, plus listed versions 1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.11.900.1-debian1-2.4ubuntu1.21.900.1-debian1-2.4ubuntu1.3 |
None known |
jasperopenSUSE:Tumbleweed |
before 4.2.3-2.1 | 4.2.3-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-31744 is a high vulnerability (CVSS 7.5) in Jasper Project Jasper, published April 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in jasper 4.2.1-2.
References
github.com/jasper-software/jasper/issues/381
nvd.nist.gov/vuln/detail/CVE-2024-31744
advisories.mageia.org/MGASA-2024-0144.html