CVE-2018-9055

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in...

5.5 MediumFix available

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.74%Up 0.4 points since Apr 14, 2021

What each source reports

NVD Score used 5.5

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.

Record: CVE-2018-9055
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-617
Updated: 2026-11-02

CVE List No score

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.

Record: CVE-2018-9055
Updated: 2026-11-02

EUVDEUVD-2018-20659 No score

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.

Record: EUVD-2018-20659
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j9mh-4xcr-p4jg 5.5

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in...

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.

Record: GHSA-j9mh-4xcr-p4jg
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-617
Updated: 2026-11-02

OSV 5.5

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.

Record: CVE-2018-9055
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-9055 5.5

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c.

Record: UBUNTU-CVE-2018-9055
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2018-0281 No score

Updated jasper packages fix security vulnerabilities

Updated japser packages fix security vulnerabilities:

An assertion failure was possible to trigger in JPC_NOMINALGAIN (CVE-2016-9396).

Denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c could lead to denial of service (CVE-2018-9055).

Record: MGASA-2018-0281
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10869-1 No score

jasper-2.0.33-1.2 on GA media

These are all security issues fixed in the jasper-2.0.33-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10869-1
Updated: 2026-11-02

OSVSUSE-SU-2018:1424-1 No score

Security update for jasper

This update for jasper fixes the following issues:

CVE-2018-9055: denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c could lead to denial of service. (bsc#1087020)

Record: SUSE-SU-2018:1424-1
Updated: 2026-11-02

Affected products

jasper project jasper

Affected packages

Affected packages
Package	Affected	Fixed
`jasper` Mageia:5 From an advisory covering 2 CVEs	before 1.900.23-1.1.mga5	1.900.23-1.1.mga5
`jasper` Mageia:6 From an advisory covering 2 CVEs	before 1.900.23-5.1.mga6	1.900.23-5.1.mga6
`jasper` SUSE:Linux Enterprise Desktop 12 SP3	before 1.900.14-195.8.1	1.900.14-195.8.1
`jasper` SUSE:Linux Enterprise Software Development Kit 12 SP3	before 1.900.14-195.8.1	1.900.14-195.8.1
`jasper` SUSE:Linux Enterprise Server 12 SP3	before 1.900.14-195.8.1	1.900.14-195.8.1
`jasper` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	before 1.900.14-195.8.1	1.900.14-195.8.1
`jasper` Ubuntu:16.04:LTS	All versions, plus listed versions 1.900.1-debian1-2.41.900.1-debian1-2.4ubuntu11.900.1-debian1-2.4ubuntu1.11.900.1-debian1-2.4ubuntu1.21.900.1-debian1-2.4ubuntu1.3	None known
`jasper` openSUSE:Tumbleweed From an advisory covering 38 CVEs	before 2.0.33-1.2	2.0.33-1.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-9055 is a medium vulnerability (CVSS 5.5) in Jasper Project Jasper, published March 27, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. Fixed in jasper 1.900.14-195.8.1.

References

Show 47 moreShow less