{"id":"CVE-2020-27828","aliases":["ALSA-2021:4235","CLSA-2026-1778218633","CLSA-2026-1778227041","CLSA-2026-1792442076","EUVD-2020-20327","GHSA-x4rf-6444-7fh8","MGASA-2020-0463","RHSA-2021:4235","RLSA-2021:4235","SUSE-SU-2021:0488-1","SUSE-SU-2021:0489-1","SUSE-SU-2021:14627-1","UBUNTU-CVE-2020-27828","USN-4688-1","openSUSE-SU-2021:0303-1","openSUSE-SU-2024:10869-1"],"status":"published","title":"There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to...","description":"There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01388,"percentile":0.72622,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-787"],"published":"2020-12-11T03:07:09Z","modified":"2026-10-29T11:01:09Z","fixes":[{"ecosystem":"Mageia:7","package":"jasper","fixed_in":["2.0.23-1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"jasper","fixed_in":["1.900.1-debian1-2.4ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"jasper-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.23-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-134.33.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-134.33.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-debian1-2.4ubuntu1.3"}]}],"versions":["1.900.1-debian1-2.4","1.900.1-debian1-2.4ubuntu1","1.900.1-debian1-2.4ubuntu1.1","1.900.1-debian1-2.4ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-debian1-2.4ubuntu1.3"}]}],"versions":["1.900.1-debian1-2.4","1.900.1-debian1-2.4ubuntu1","1.900.1-debian1-2.4ubuntu1.1","1.900.1-debian1-2.4ubuntu1.2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-lp152.7.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.33-1.2"}]}],"bundled":38}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"jasper_project","product":"jasper"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1905201","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/jasper-software/jasper/issues/252","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EBZZ2SNTQ4BSA6PNJCTOAKXIAXYNNF6V/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COBEVDBUO3QTNR6YQBBTIQKNIB6W3MJ2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPOVZTSIQPW2H4AFLMI3LHJEZGBVEQET/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27828","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/COBEVDBUO3QTNR6YQBBTIQKNIB6W3MJ2/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EBZZ2SNTQ4BSA6PNJCTOAKXIAXYNNF6V/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPOVZTSIQPW2H4AFLMI3LHJEZGBVEQET/"},{"url":"https://github.com/advisories/GHSA-x4rf-6444-7fh8"},{"url":"https://errata.almalinux.org/8/ALSA-2021-4235.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-27828","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-26926","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-26927","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3272","tags":["report"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1778218633.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3443","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8836","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1778227041.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792442076.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8837","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0463.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27842","tags":["report"]},{"url":"https://github.com/jasper-software/jasper/releases/tag/version-2.0.23","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4235","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921428","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4235.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-27828","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-27828","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3272","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3272","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-26926","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26926","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-26927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26927","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4235","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210488-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1179748","tags":["report"]},{"url":"https://bugzilla.suse.com/1181483","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3272","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210489-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114627-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-27828","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4688-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-9782","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18873","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19542","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/I6ZF7VRY24X2GVC7MCP6MQKQBRKCSJ2A/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9252","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-27828","description":"There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.","status":"published","published":"2020-12-11T03:07:09Z","modified":"2024-08-04T16:25:43.579Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:53.236501Z"}],"euvd":[{"id":"EUVD-2020-20327","description":"There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.","status":"published","published":"2020-12-11T03:07:09Z","modified":"2024-08-04T16:25:43Z","updated_at":"2026-11-03T03:07:11.950168Z"}],"ghsa":[{"id":"GHSA-x4rf-6444-7fh8","title":"There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to...","description":"There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.","status":"published","published":"2022-05-24T17:36:04Z","modified":"2023-01-27T05:02:52Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20","CWE-787"],"updated_at":"2026-11-02T14:42:06.943612Z"}],"nvd":[{"id":"CVE-2020-27828","description":"There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.","status":"published","published":"2020-12-11T04:15:11.83Z","modified":"2026-06-17T03:09:41.89Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"CVE-2020-27828","description":"There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.","status":"published","published":"2020-12-11T04:15:11.83Z","modified":"2026-10-20T10:53:01.668062686Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"RHSA-2021:4235","title":"Red Hat Security Advisory: jasper security update","status":"published","published":"2024-09-16T06:00:56Z","modified":"2026-06-27T10:14:23Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4235","title":"Moderate: jasper security update","description":"JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.\n\nSecurity Fix(es):\n\n* jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c (CVE-2020-27828)\n\n* jasper: Heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2021-3272)\n\n* jasper: Out of bounds read in jp2_decode() in jp2_dec.c (CVE-2021-26926)\n\n* jasper: NULL pointer dereference in jp2_decode() in jp2_dec.c (CVE-2021-26927)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:48:32Z","modified":"2026-02-05T08:30:09.267229Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-27828","description":"There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.","status":"published","published":"2020-12-11T04:15:00Z","modified":"2026-04-22T12:38:38.478842Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"ALSA-2021:4235","title":"Moderate: jasper security update","description":"JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.\n\nSecurity Fix(es):\n\n* jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c (CVE-2020-27828)\n\n* jasper: Heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2021-3272)\n\n* jasper: Out of bounds read in jp2_decode() in jp2_dec.c (CVE-2021-26926)\n\n* jasper: NULL pointer dereference in jp2_decode() in jp2_dec.c (CVE-2021-26927)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:48:32Z","modified":"2026-10-29T11:01:09.988186302Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1778218633","title":"jasper: Fix of 3 CVEs","description":"- Add Amazon Linux 2 ELS support (mirrors centos7els branch with .amzn2 dist\n  via / leapfrog over stock 1.900.1-33.amzn2.0.1)\n- Import CVE-2020-27828 patch from amzn2 stock SRPM (out-of-bounds write in\n  jpc encoder; jasper-2.0.14-CVE-2020-27828.patch)\n- Import CVE-2021-3443 patch from amzn2 stock SRPM (NULL pointer dereference\n  in JP2 component reference handling)\n- Import CVE-2021-3467 patch from amzn2 stock SRPM (NULL pointer dereference\n  in CDEF box channel reference handling)","status":"published","published":"2026-06-24T12:05:18Z","modified":"2026-10-26T09:31:53.995657041Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778227041","title":"jasper: Fix of 3 CVEs","description":"- Add Amazon Linux 2 ELS support (mirrors centos7els branch with .amzn2 dist\n  via / leapfrog over stock 1.900.1-33.amzn2.0.1)\n- Import CVE-2020-27828 patch from amzn2 stock SRPM (out-of-bounds write in\n  jpc encoder; jasper-2.0.14-CVE-2020-27828.patch)\n- Import CVE-2021-3443 patch from amzn2 stock SRPM (NULL pointer dereference\n  in JP2 component reference handling)\n- Import CVE-2021-3467 patch from amzn2 stock SRPM (NULL pointer dereference\n  in CDEF box channel reference handling)","status":"published","published":"2026-05-08T11:49:13Z","modified":"2026-06-01T00:33:18.898265073Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1792442076","title":"jasper: Fix of 4 CVEs","description":"- Add Amazon Linux 2 ELS support (mirrors centos7els branch with .amzn2 dist\n  via / leapfrog over stock 1.900.1-33.amzn2.0.1)\n- Import CVE-2020-27828 patch from amzn2 stock SRPM (out-of-bounds write in\n  jpc encoder; jasper-2.0.14-CVE-2020-27828.patch)\n- Import CVE-2021-3443 patch from amzn2 stock SRPM (NULL pointer dereference\n  in JP2 component reference handling)\n- Import CVE-2021-3467 patch from amzn2 stock SRPM (NULL pointer dereference\n  in CDEF box channel reference handling)","status":"published","published":"2026-10-19T20:34:50Z","modified":"2026-10-26T09:31:59.328120976Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"MGASA-2020-0463","title":"Updated jasper packages fix security vulnerability","description":"There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted\ninput provided to jasper by an attacker could cause an arbitrary out-of-bounds\nwrite. This could potentially affect data confidentiality, integrity, or\napplication availability (CVE-2020-27828).\n","status":"published","published":"2020-12-17T13:10:41Z","modified":"2026-04-16T04:44:07.766112475Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0303-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls\n- bsc#1181483 CVE-2021-3272: Fix buffer over-read in jp2_decode\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-02-18T06:52:10Z","modified":"2026-02-04T03:31:41.768908Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10869-1","title":"jasper-2.0.33-1.2 on GA media","description":"These are all security issues fixed in the jasper-2.0.33-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:39.137926Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:0488-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls\n- bsc#1181483 CVE-2021-3272: Fix buffer over-read in jp2_decode\n","status":"published","published":"2021-02-16T11:43:43Z","modified":"2026-02-04T04:02:20.863298Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0489-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls\n- bsc#1181483 CVE-2021-3272: Fix buffer over-read in jp2_decode\n","status":"published","published":"2021-02-16T12:02:33Z","modified":"2026-02-04T04:39:16.967122Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:14627-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls\n- bsc#1181483 CVE-2021-3272: Fix buffer over-read in jp2_decode\n","status":"published","published":"2021-02-16T09:04:28Z","modified":"2026-02-04T03:41:07.110182Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4688-1","title":"jasper vulnerabilities","description":"It was discovered that Jasper incorrectly certain files.\nAn attacker could possibly use this issue to cause a crash.\n(CVE-2018-18873)\n\nIt was discovered that Jasper incorrectly handled certain files.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2018-19542)\n\nIt was discovered that Jasper incorrectly handled certain JPC encoders.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2020-27828)\n\nIt was discovered that Jasper incorrectly handled certain images.\nAn attacker could possibly use this issue to expose sensitive information\nor cause a crash.\n(CVE-2017-9782)\n","status":"published","published":"2021-01-11T12:42:31Z","modified":"2026-04-22T10:10:55.945661Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}