Every CVE Search/ Get API key

CVE-2011-4517

The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data...

6.8 MediumFix available

The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.

Exploit likelihood

10.5%Up 3.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.

Record
CVE-2011-4517
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.

Record
CVE-2011-4517
Updated
2026-11-02
EUVDEUVD-2011-4443 No score

The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.

Record
EUVD-2011-4443
Updated
2026-11-03
GitHub AdvisoriesGHSA-fh37-rq45-7gc5 No score

The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data...

The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.

Record
GHSA-fh37-rq45-7gc5
Weakness
CWE-119, CWE-787
Updated
2026-11-02
OSV No score

The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.

Record
CVE-2011-4517
Updated
2026-11-02
OSVDEBIAN-CVE-2011-4517 No score

The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.

Record
DEBIAN-CVE-2011-4517
Updated
2026-11-02
OSVopenSUSE-SU-2024:10281-1 No score

jasper-1.900.14-3.1 on GA media

These are all security issues fixed in the jasper-1.900.14-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10281-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ghostscript
Debian:12
 before 8.64~dfsg-2
8.64~dfsg-2
ghostscript
Debian:13
 before 8.64~dfsg-2
8.64~dfsg-2
ghostscript
Debian:14
 before 8.64~dfsg-2
8.64~dfsg-2
jasper
Debian:6.0
From an advisory covering 2 CVEs
 before 1.900.1-7+squeeze1, plus listed versions
1.900.1-7
1.900.1-7+squeeze1
jasper
Debian:5.0
From an advisory covering 2 CVEs
 before 1.900.1-5.1+lenny2, plus listed versions
1.900.1-5.11.900.1-5.1+lenny1
1.900.1-5.1+lenny2
jasper
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-libs
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-utils
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
Show 47 moreShow less
Affected packages
PackageAffectedFixed
jasper
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-libs
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-utils
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-libs
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-utils
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-libs
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
jasper-utils
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 0:1.900.1-15.el6_1.1
0:1.900.1-15.el6_1.1
netpbm
Red Hat:enterprise_linux:4::as
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-debuginfo
Red Hat:enterprise_linux:4::as
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-devel
Red Hat:enterprise_linux:4::as
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-progs
Red Hat:enterprise_linux:4::as
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm
Red Hat:enterprise_linux:4::desktop
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-debuginfo
Red Hat:enterprise_linux:4::desktop
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-devel
Red Hat:enterprise_linux:4::desktop
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-progs
Red Hat:enterprise_linux:4::desktop
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm
Red Hat:enterprise_linux:4::es
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-debuginfo
Red Hat:enterprise_linux:4::es
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-devel
Red Hat:enterprise_linux:4::es
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-progs
Red Hat:enterprise_linux:4::es
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm
Red Hat:enterprise_linux:4::ws
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-debuginfo
Red Hat:enterprise_linux:4::ws
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-devel
Red Hat:enterprise_linux:4::ws
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm-progs
Red Hat:enterprise_linux:4::ws
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el4
0:10.35.58-8.el4
netpbm
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el5_7.3
0:10.35.58-8.el5_7.3
netpbm-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el5_7.3
0:10.35.58-8.el5_7.3
netpbm-progs
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el5_7.3
0:10.35.58-8.el5_7.3
netpbm
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el5_7.3
0:10.35.58-8.el5_7.3
netpbm-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el5_7.3
0:10.35.58-8.el5_7.3
netpbm-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el5_7.3
0:10.35.58-8.el5_7.3
netpbm
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el5_7.3
0:10.35.58-8.el5_7.3
netpbm-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el5_7.3
0:10.35.58-8.el5_7.3
netpbm-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el5_7.3
0:10.35.58-8.el5_7.3
netpbm-progs
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
 before 0:10.35.58-8.el5_7.3
0:10.35.58-8.el5_7.3
rhevm-spice-client
Red Hat:rhev_manager:3
From an advisory covering 9 CVEs
 before 0:3.5-3.el6
0:3.5-3.el6
rhevm-spice-client-x64-cab
Red Hat:rhev_manager:3
From an advisory covering 9 CVEs
 before 0:3.5-3.el6
0:3.5-3.el6
rhevm-spice-client-x64-msi
Red Hat:rhev_manager:3
From an advisory covering 9 CVEs
 before 0:3.5-3.el6
0:3.5-3.el6
rhevm-spice-client-x86-cab
Red Hat:rhev_manager:3
From an advisory covering 9 CVEs
 before 0:3.5-3.el6
0:3.5-3.el6
rhevm-spice-client-x86-msi
Red Hat:rhev_manager:3
From an advisory covering 9 CVEs
 before 0:3.5-3.el6
0:3.5-3.el6
jasper
openSUSE:Tumbleweed
From an advisory covering 30 CVEs
 before 1.900.14-3.1
1.900.14-3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-4517 is a medium vulnerability (CVSS 6.8) in Jasper Project Jasper, published December 15, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.5%, the 95th percentile. Fixed in ghostscript 8.64~dfsg-2.

References

Show 95 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open