CVE-2008-3520
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an...
9.3 HighFix available
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
Exploit likelihood
3.21%Up 0.5 points since Feb 4, 2022
What each source reports
NVD Score used
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
- Record
CVE-2008-3520- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
- Record
CVE-2008-3520- Updated
- 2026-11-02
EUVDEUVD-2008-3506 No score
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
- Record
EUVD-2008-3506- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-83j4-67f2-p565 No score
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an...
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
- Record
GHSA-83j4-67f2-p565- Updated
- 2026-11-02
OSV No score
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
- Record
CVE-2008-3520- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-3520 No score
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
- Record
DEBIAN-CVE-2008-3520- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ghostscriptDebian:12 |
before 8.64~dfsg-2 | 8.64~dfsg-2 |
ghostscriptDebian:13 |
before 8.64~dfsg-2 | 8.64~dfsg-2 |
ghostscriptDebian:14 |
before 8.64~dfsg-2 | 8.64~dfsg-2 |
netpbmRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbm-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbm-develRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbm-progsRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbmRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbm-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbm-develRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
netpbm-progsRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbmRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbm-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbm-develRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbm-progsRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbmRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbm-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbm-develRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbm-progsRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:10.25-2.1.el4_7.4 | 0:10.25-2.1.el4_7.4 |
netpbmRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:10.35-6.1.el5_3.1 | 0:10.35-6.1.el5_3.1 |
netpbm-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:10.35-6.1.el5_3.1 | 0:10.35-6.1.el5_3.1 |
netpbm-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:10.35-6.1.el5_3.1 | 0:10.35-6.1.el5_3.1 |
netpbmRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:10.35-6.1.el5_3.1 | 0:10.35-6.1.el5_3.1 |
netpbm-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:10.35-6.1.el5_3.1 | 0:10.35-6.1.el5_3.1 |
netpbm-progsRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:10.35-6.1.el5_3.1 | 0:10.35-6.1.el5_3.1 |
netpbmRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:10.35-6.1.el5_3.1 | 0:10.35-6.1.el5_3.1 |
netpbm-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:10.35-6.1.el5_3.1 | 0:10.35-6.1.el5_3.1 |
netpbm-develRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:10.35-6.1.el5_3.1 | 0:10.35-6.1.el5_3.1 |
netpbm-progsRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:10.35-6.1.el5_3.1 | 0:10.35-6.1.el5_3.1 |
rhevm-spice-clientRed Hat:rhev_manager:3 From an advisory covering 9 CVEs |
before 0:3.5-3.el6 | 0:3.5-3.el6 |
rhevm-spice-client-x64-cabRed Hat:rhev_manager:3 From an advisory covering 9 CVEs |
before 0:3.5-3.el6 | 0:3.5-3.el6 |
rhevm-spice-client-x64-msiRed Hat:rhev_manager:3 From an advisory covering 9 CVEs |
before 0:3.5-3.el6 | 0:3.5-3.el6 |
rhevm-spice-client-x86-cabRed Hat:rhev_manager:3 From an advisory covering 9 CVEs |
before 0:3.5-3.el6 | 0:3.5-3.el6 |
rhevm-spice-client-x86-msiRed Hat:rhev_manager:3 From an advisory covering 9 CVEs |
before 0:3.5-3.el6 | 0:3.5-3.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3520 is a high vulnerability (CVSS 9.3) in Jasper Project Jasper, published October 2, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.21%, the 88th percentile. Fixed in ghostscript 8.64~dfsg-2.
References
securityfocus.com/bid/31470
mandriva.com/security/advisories?name=MDVSA-2009:164
redhat.com/support/errata/RHSA-2009-0012.html
exchange.xforce.ibmcloud.com/vulnerabilities/45621
secunia.com/advisories/34391
Show 59 moreShow less
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10141
bugs.gentoo.org/show_bug.cgi?id=222819
ubuntu.com/usn/USN-742-1
rhn.redhat.com/errata/RHSA-2015-0698.html
security.gentoo.org/glsa/glsa-200812-18.xml
slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.538606
nvd.nist.gov/vuln/detail/CVE-2008-3520
github.com/advisories/GHSA-83j4-67f2-p565
security-tracker.debian.org/tracker/CVE-2008-3520
access.redhat.com/errata/RHSA-2009:0012
bugzilla.redhat.com/show_bug.cgi?id=346501
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0012.json
cve.org/CVERecord?id=CVE-2007-2721
ocert.org/advisories/ocert-2014-012.html