{"id":"CVE-2021-3272","aliases":["ALSA-2021:4235","AZL-6493","CLSA-2026-1776849467","CLSA-2026-1777456996","EUVD-2021-26610","GHSA-g2j5-mv4m-h6rc","MGASA-2021-0113","RHSA-2021:4235","RLSA-2021:4235","SUSE-SU-2021:0488-1","SUSE-SU-2021:0489-1","SUSE-SU-2021:14627-1","UBUNTU-CVE-2021-3272","openSUSE-SU-2021:0303-1","openSUSE-SU-2024:10869-1"],"status":"published","title":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when...","description":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0112,"percentile":0.6641,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2021-01-27T07:29:02Z","modified":"2026-10-29T11:01:09Z","fixes":[{"ecosystem":"Azure Linux:2","package":"jasper","fixed_in":["2.0.32-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.32-2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els5"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.25-1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"jasper-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"jasper-utils-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.14-5.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-3.19.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-134.33.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-134.33.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.900.1-debian1-2.4","1.900.1-debian1-2.4ubuntu1","1.900.1-debian1-2.4ubuntu1.1","1.900.1-debian1-2.4ubuntu1.2","1.900.1-debian1-2.4ubuntu1.3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-lp152.7.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.33-1.2"}]}],"bundled":38}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"jasper_project","product":"jasper"}],"references":[{"url":"https://github.com/jasper-software/jasper/issues/259","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HD2Y2LT4N5ZWCMKYCUIKB3XODNJLOW3J/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BZFU2F6UW4L2FJE65WJLWGUIELDWCL7/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3272","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BZFU2F6UW4L2FJE65WJLWGUIELDWCL7/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HD2Y2LT4N5ZWCMKYCUIKB3XODNJLOW3J/"},{"url":"https://github.com/advisories/GHSA-g2j5-mv4m-h6rc"},{"url":"https://errata.almalinux.org/8/ALSA-2021-4235.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-27828","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-26926","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-26927","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3272","tags":["report"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1776849467.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1777456996.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51257","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0113.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28318","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HD2Y2LT4N5ZWCMKYCUIKB3XODNJLOW3J/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZSE7IN2V4KAQDTSMRIVDIHQ6XXFC4AUH/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4235","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1905201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1921428","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4235.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-27828","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-27828","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27828","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3272","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3272","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-26926","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26926","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-26927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26927","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4235","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210488-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1179748","tags":["report"]},{"url":"https://bugzilla.suse.com/1181483","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3272","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210489-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114627-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3272","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/I6ZF7VRY24X2GVC7MCP6MQKQBRKCSJ2A/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10251","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9252","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3272","description":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.","status":"published","published":"2021-01-27T07:29:02Z","modified":"2024-08-03T16:53:16.007Z","updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26610","description":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.","status":"published","published":"2021-01-27T07:29:02Z","modified":"2024-08-03T16:53:16Z","updated_at":"2026-11-03T03:25:13.531128Z"}],"ghsa":[{"id":"GHSA-g2j5-mv4m-h6rc","title":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when...","description":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.","status":"published","published":"2022-05-24T17:40:29Z","modified":"2023-01-29T05:05:31Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:45:48.864861Z"}],"nvd":[{"id":"CVE-2021-3272","description":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.","status":"published","published":"2021-01-27T08:15:10.483Z","modified":"2026-06-17T04:04:52.377Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:49.660551Z"}],"osv":[{"id":"AZL-6493","title":"CVE-2021-3272 affecting package jasper for versions less than 2.0.32-2","description":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.","status":"published","published":"2021-01-27T08:15:10Z","modified":"2026-04-21T04:32:37.58806Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"CVE-2021-3272","description":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.","status":"published","published":"2021-01-27T08:15:10.483Z","modified":"2026-10-20T10:54:42.549009304Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"RHSA-2021:4235","title":"Red Hat Security Advisory: jasper security update","status":"published","published":"2024-09-16T06:00:56Z","modified":"2026-06-27T10:14:23Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4235","title":"Moderate: jasper security update","description":"JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.\n\nSecurity Fix(es):\n\n* jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c (CVE-2020-27828)\n\n* jasper: Heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2021-3272)\n\n* jasper: Out of bounds read in jp2_decode() in jp2_dec.c (CVE-2021-26926)\n\n* jasper: NULL pointer dereference in jp2_decode() in jp2_dec.c (CVE-2021-26927)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:48:32Z","modified":"2026-02-05T08:30:09.267229Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-3272","description":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.","status":"published","published":"2021-01-27T08:15:00Z","modified":"2026-04-22T12:53:43.962107Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"ALSA-2021:4235","title":"Moderate: jasper security update","description":"JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.\n\nSecurity Fix(es):\n\n* jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c (CVE-2020-27828)\n\n* jasper: Heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2021-3272)\n\n* jasper: Out of bounds read in jp2_decode() in jp2_dec.c (CVE-2021-26926)\n\n* jasper: NULL pointer dereference in jp2_decode() in jp2_dec.c (CVE-2021-26927)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:48:32Z","modified":"2026-10-29T11:01:09.988186302Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1776849467","title":"jasper: Fix of 3 CVEs","description":"- CVE-2021-26926: prevent out-of-bounds read in jp2_decode by hard-erroring on inconsistent IHDR/BPCC component metadata\n- CVE-2021-26927: prevent out-of-bounds read in jp2_decode by hard-erroring on inconsistent IHDR/BPCC component metadata\n- CVE-2021-3272: prevent heap-based buffer over-read in jp2_decode by hard-erroring when the decoder channel count exceeds the image component count","status":"published","published":"2026-04-25T08:37:48Z","modified":"2026-06-01T00:33:09.960985333Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777456996","title":"jasper: Fix of 2 CVEs","description":"- CVE-2021-26926: prevent out-of-bounds read in jp2_decode by hard-erroring on inconsistent IHDR/BPCC component metadata\n- CVE-2021-26927: prevent out-of-bounds read in jp2_decode by hard-erroring on inconsistent IHDR/BPCC component metadata\n- CVE-2021-3272: prevent heap-based buffer over-read in jp2_decode by hard-erroring when the decoder channel count exceeds the image component count","status":"published","published":"2026-07-07T09:20:20Z","modified":"2026-10-26T09:31:54.53329595Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"MGASA-2021-0113","title":"Updated jasper packages fix security vulnerability","description":"jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based\nbuffer over-read when there is an invalid relationship between the number of\nchannels and the number of image components (CVE-2021-3272).\n\nA flaw was found in jasper. An out of bounds read issue was found in jp2_decode\nfunction which may lead to disclosure of information or program crash\n(CVE-2021-26926).\n\nA flaw was found in jasper. A null pointer dereference in jp2_decode in\njp2_dec.c may lead to program crash and denial of service (CVE-2021-26927).\n","status":"published","published":"2021-03-04T16:53:32Z","modified":"2026-04-16T04:42:19.108632013Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0303-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls\n- bsc#1181483 CVE-2021-3272: Fix buffer over-read in jp2_decode\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-02-18T06:52:10Z","modified":"2026-02-04T03:31:41.768908Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10869-1","title":"jasper-2.0.33-1.2 on GA media","description":"These are all security issues fixed in the jasper-2.0.33-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:39.137926Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:0488-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls\n- bsc#1181483 CVE-2021-3272: Fix buffer over-read in jp2_decode\n","status":"published","published":"2021-02-16T11:43:43Z","modified":"2026-02-04T04:02:20.863298Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0489-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls\n- bsc#1181483 CVE-2021-3272: Fix buffer over-read in jp2_decode\n","status":"published","published":"2021-02-16T12:02:33Z","modified":"2026-02-04T04:39:16.967122Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:14627-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- bsc#1179748 CVE-2020-27828: Fix heap overflow by checking maxrlvls\n- bsc#1181483 CVE-2021-3272: Fix buffer over-read in jp2_decode\n","status":"published","published":"2021-02-16T09:04:28Z","modified":"2026-02-04T03:41:07.110182Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}