{"id":"CVE-2021-26927","aliases":["ALSA-2021:4235","AZL-6492","CLSA-2026-1776849467","CLSA-2026-1777456996","EUVD-2021-13709","GHSA-9768-8435-chr8","MGASA-2021-0113","RHSA-2021:4235","RLSA-2021:4235","SUSE-SU-2022:1475-1","SUSE-SU-2022:1479-1","UBUNTU-CVE-2021-26927","openSUSE-SU-2024:13389-1"],"status":"published","title":"A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c...","description":"A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0109,"percentile":0.65791,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2021-02-23T19:03:29Z","modified":"2026-10-29T11:01:09Z","fixes":[{"ecosystem":"Azure Linux:2","package":"jasper","fixed_in":["2.0.32-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.32-2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.25-1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.900.1-debian1-2.4","1.900.1-debian1-2.4ubuntu1","1.900.1-debian1-2.4ubuntu1.1","1.900.1-debian1-2.4ubuntu1.2","1.900.1-debian1-2.4ubuntu1.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-2.1"}]}],"bundled":5}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"jasper_project","product":"jasper"}],"references":[{"url":"https://github.com/jasper-software/jasper/commit/41f214b121b837fa30d9ca5f2430212110f5cd9b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/jasper-software/jasper/issues/265","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYVCFVTVPL66OS7LCNLUSYCMYQAVWXMM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YRZFZSJ4UVLLMXSKHR455TAC2SD3TOHI/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JSXESYUHMO522Z3RHXOQ2SJNWP3XTO67/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26927","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JSXESYUHMO522Z3RHXOQ2SJNWP3XTO67/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JYVCFVTVPL66OS7LCNLUSYCMYQAVWXMM/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YRZFZSJ4UVLLMXSKHR455TAC2SD3TOHI/"},{"url":"https://github.com/advisories/GHSA-9768-8435-chr8"},{"url":"https://errata.almalinux.org/8/ALSA-2021-4235.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-27828","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-26926","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-26927","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3272","tags":["report"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1776849467.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1777456996.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51257","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0113.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28318","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HD2Y2LT4N5ZWCMKYCUIKB3XODNJLOW3J/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZSE7IN2V4KAQDTSMRIVDIHQ6XXFC4AUH/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4235","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1905201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921428","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4235.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-27828","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-27828","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27828","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3272","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3272","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-26926","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26926","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-26927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26927","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4235","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221475-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182104","tags":["report"]},{"url":"https://bugzilla.suse.com/1182105","tags":["report"]},{"url":"https://bugzilla.suse.com/1184757","tags":["report"]},{"url":"https://bugzilla.suse.com/1184798","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3467","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221479-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-26927","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27845","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-26927","description":"A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.","status":"published","published":"2021-02-23T19:03:29Z","modified":"2024-08-03T20:33:41.507Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:32:57.368269Z"}],"euvd":[{"id":"EUVD-2021-13709","description":"A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.","status":"published","published":"2021-02-23T19:03:29Z","modified":"2024-08-03T20:33:41Z","updated_at":"2026-11-03T03:24:50.84326Z"}],"ghsa":[{"id":"GHSA-9768-8435-chr8","title":"A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c...","description":"A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.","status":"published","published":"2022-05-24T17:42:56Z","modified":"2023-01-29T05:05:50Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:45:53.268312Z"}],"nvd":[{"id":"CVE-2021-26927","description":"A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.","status":"published","published":"2021-02-23T20:15:12.04Z","modified":"2026-06-17T03:44:01.387Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"AZL-6492","title":"CVE-2021-26927 affecting package jasper for versions less than 2.0.32-2","description":"A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.","status":"published","published":"2021-02-23T20:15:12Z","modified":"2026-04-21T04:32:37.086104Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"CVE-2021-26927","description":"A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.","status":"published","published":"2021-02-23T20:15:12.04Z","modified":"2026-10-20T14:17:31.370422252Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:18.778776Z"},{"id":"RHSA-2021:4235","title":"Red Hat Security Advisory: jasper security update","status":"published","published":"2024-09-16T06:00:56Z","modified":"2026-06-27T10:14:23Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4235","title":"Moderate: jasper security update","description":"JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.\n\nSecurity Fix(es):\n\n* jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c (CVE-2020-27828)\n\n* jasper: Heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2021-3272)\n\n* jasper: Out of bounds read in jp2_decode() in jp2_dec.c (CVE-2021-26926)\n\n* jasper: NULL pointer dereference in jp2_decode() in jp2_dec.c (CVE-2021-26927)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:48:32Z","modified":"2026-02-05T08:30:09.267229Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-26927","description":"A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service.","status":"published","published":"2021-02-23T20:15:00Z","modified":"2026-04-22T12:50:13.568114Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"ALSA-2021:4235","title":"Moderate: jasper security update","description":"JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.\n\nSecurity Fix(es):\n\n* jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c (CVE-2020-27828)\n\n* jasper: Heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2021-3272)\n\n* jasper: Out of bounds read in jp2_decode() in jp2_dec.c (CVE-2021-26926)\n\n* jasper: NULL pointer dereference in jp2_decode() in jp2_dec.c (CVE-2021-26927)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:48:32Z","modified":"2026-10-29T11:01:09.988186302Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1776849467","title":"jasper: Fix of 3 CVEs","description":"- CVE-2021-26926: prevent out-of-bounds read in jp2_decode by hard-erroring on inconsistent IHDR/BPCC component metadata\n- CVE-2021-26927: prevent out-of-bounds read in jp2_decode by hard-erroring on inconsistent IHDR/BPCC component metadata\n- CVE-2021-3272: prevent heap-based buffer over-read in jp2_decode by hard-erroring when the decoder channel count exceeds the image component count","status":"published","published":"2026-04-25T08:37:48Z","modified":"2026-06-01T00:33:09.960985333Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777456996","title":"jasper: Fix of 2 CVEs","description":"- CVE-2021-26926: prevent out-of-bounds read in jp2_decode by hard-erroring on inconsistent IHDR/BPCC component metadata\n- CVE-2021-26927: prevent out-of-bounds read in jp2_decode by hard-erroring on inconsistent IHDR/BPCC component metadata\n- CVE-2021-3272: prevent heap-based buffer over-read in jp2_decode by hard-erroring when the decoder channel count exceeds the image component count","status":"published","published":"2026-07-07T09:20:20Z","modified":"2026-10-26T09:31:54.53329595Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"MGASA-2021-0113","title":"Updated jasper packages fix security vulnerability","description":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based\nbuffer over-read when there is an invalid relationship between the number of\nchannels and the number of image components (CVE-2021-3272).\n\nA flaw was found in jasper. An out of bounds read issue was found in jp2_decode\nfunction which may lead to disclosure of information or program crash\n(CVE-2021-26926).\n\nA flaw was found in jasper. A null pointer dereference in jp2_decode in\njp2_dec.c may lead to program crash and denial of service (CVE-2021-26927).\n","status":"published","published":"2021-03-04T16:53:32Z","modified":"2026-04-16T04:42:19.108632013Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:13389-1","title":"jasper-4.0.0-2.1 on GA media","description":"These are all security issues fixed in the jasper-4.0.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:56:56.906257Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2022:1475-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- CVE-2021-3467: Fixed NULL pointer deref in jp2_decode() (bsc#1184757). \n- CVE-2021-3443: Fixed NULL pointer deref in jp2_decode() (bsc#1184798).\n- CVE-2021-26927: Fixed NULL pointer deref in jp2_decode() (bsc#1182104).\n- CVE-2021-26926: Fixed an out of bounds read in jp2_decode() (bsc#1182105).\n","status":"published","published":"2022-04-29T15:31:15Z","modified":"2026-02-04T02:36:40.190738Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1479-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- CVE-2021-3467: Fixed NULL pointer deref in jp2_decode() (bsc#1184757). \n- CVE-2021-3443: Fixed NULL pointer deref in jp2_decode() (bsc#1184798).\n- CVE-2021-26927: Fixed NULL pointer deref in jp2_decode() (bsc#1182104).\n- CVE-2021-26926: Fixed an out of bounds read in jp2_decode() (bsc#1182105).\n","status":"published","published":"2022-04-29T15:32:30Z","modified":"2026-02-04T02:30:11.811759Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}