{"id":"CVE-2021-3443","aliases":["AZL-6494","CLSA-2026-1778218633","CLSA-2026-1778227041","CLSA-2026-1792442076","EUVD-2021-26769","GHSA-f675-2h8m-hfrq","MGASA-2021-0249","SUSE-SU-2022:1475-1","SUSE-SU-2022:1479-1","UBUNTU-CVE-2021-3443","openSUSE-SU-2024:13389-1"],"status":"published","title":"A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled...","description":"A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00762,"percentile":0.5562,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2021-03-25T18:45:18Z","modified":"2026-10-26T09:31:59Z","fixes":[{"ecosystem":"Azure Linux:2","package":"jasper","fixed_in":["2.0.32-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.32-2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"jasper-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"jasper-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"jasper-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"jasper-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"jasper-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.1-33.el7.tuxcare.els6"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.27-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.27-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"mingw-jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.27-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.31.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.25.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.900.1-debian1-2.4","1.900.1-debian1-2.4ubuntu1","1.900.1-debian1-2.4ubuntu1.1","1.900.1-debian1-2.4ubuntu1.2","1.900.1-debian1-2.4ubuntu1.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-2.1"}]}],"bundled":5}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"jasper_project","product":"jasper"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1939233","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3443","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-f675-2h8m-hfrq"},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1778218633.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8836","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1778227041.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792442076.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8837","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0249.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29017","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KWAIUFNIUCGS2IMGGDTWZIUIY7BNLGKF/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6OUXMOIV77VDB6PQ4K2ZRB44DQYYHIXW/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221475-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182104","tags":["report"]},{"url":"https://bugzilla.suse.com/1182105","tags":["report"]},{"url":"https://bugzilla.suse.com/1184757","tags":["report"]},{"url":"https://bugzilla.suse.com/1184798","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-26927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3467","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221479-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3443","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3443","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27845","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3443","description":"A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.","status":"published","published":"2021-03-25T18:45:18Z","modified":"2024-08-03T16:53:17.623Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-26769","description":"A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.","status":"published","published":"2021-03-25T18:45:18Z","modified":"2024-08-03T16:53:17Z","updated_at":"2026-11-03T03:25:13.052236Z"}],"ghsa":[{"id":"GHSA-f675-2h8m-hfrq","title":"A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled...","description":"A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.","status":"published","published":"2022-05-24T17:45:28Z","modified":"2023-01-29T05:06:59Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:46:07.768849Z"}],"nvd":[{"id":"CVE-2021-3443","description":"A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.","status":"published","published":"2021-03-25T19:15:14.627Z","modified":"2026-06-17T04:05:06.59Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:06:51.197859Z"}],"osv":[{"id":"AZL-6494","title":"CVE-2021-3443 affecting package jasper for versions less than 2.0.32-2","description":"A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.","status":"published","published":"2021-03-25T19:15:14Z","modified":"2026-04-21T04:32:37.56648Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"CVE-2021-3443","description":"A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.","status":"published","published":"2021-03-25T19:15:14.627Z","modified":"2026-10-24T10:30:59.430407691Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"UBUNTU-CVE-2021-3443","description":"A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.","status":"published","published":"2021-03-25T19:15:00Z","modified":"2026-04-22T12:54:49.39263Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"CLSA-2026-1778218633","title":"jasper: Fix of 3 CVEs","description":"- Add Amazon Linux 2 ELS support (mirrors centos7els branch with .amzn2 dist\n  via / leapfrog over stock 1.900.1-33.amzn2.0.1)\n- Import CVE-2020-27828 patch from amzn2 stock SRPM (out-of-bounds write in\n  jpc encoder; jasper-2.0.14-CVE-2020-27828.patch)\n- Import CVE-2021-3443 patch from amzn2 stock SRPM (NULL pointer dereference\n  in JP2 component reference handling)\n- Import CVE-2021-3467 patch from amzn2 stock SRPM (NULL pointer dereference\n  in CDEF box channel reference handling)","status":"published","published":"2026-06-24T12:05:18Z","modified":"2026-10-26T09:31:53.995657041Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778227041","title":"jasper: Fix of 3 CVEs","description":"- Add Amazon Linux 2 ELS support (mirrors centos7els branch with .amzn2 dist\n  via / leapfrog over stock 1.900.1-33.amzn2.0.1)\n- Import CVE-2020-27828 patch from amzn2 stock SRPM (out-of-bounds write in\n  jpc encoder; jasper-2.0.14-CVE-2020-27828.patch)\n- Import CVE-2021-3443 patch from amzn2 stock SRPM (NULL pointer dereference\n  in JP2 component reference handling)\n- Import CVE-2021-3467 patch from amzn2 stock SRPM (NULL pointer dereference\n  in CDEF box channel reference handling)","status":"published","published":"2026-05-08T11:49:13Z","modified":"2026-06-01T00:33:18.898265073Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1792442076","title":"jasper: Fix of 4 CVEs","description":"- Add Amazon Linux 2 ELS support (mirrors centos7els branch with .amzn2 dist\n  via / leapfrog over stock 1.900.1-33.amzn2.0.1)\n- Import CVE-2020-27828 patch from amzn2 stock SRPM (out-of-bounds write in\n  jpc encoder; jasper-2.0.14-CVE-2020-27828.patch)\n- Import CVE-2021-3443 patch from amzn2 stock SRPM (NULL pointer dereference\n  in JP2 component reference handling)\n- Import CVE-2021-3467 patch from amzn2 stock SRPM (NULL pointer dereference\n  in CDEF box channel reference handling)","status":"published","published":"2026-10-19T20:34:50Z","modified":"2026-10-26T09:31:59.328120976Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"MGASA-2021-0249","title":"Updated jasper packages fix security vulnerabilities","description":"A NULL pointer dereference flaw was found in the way Jasper versions before \n2.0.27 handled component references in the JP2 image format decoder. A \nspecially crafted JP2 image file could cause an application using the Jasper \nlibrary to crash when opened (CVE-2021-3443).\n\nA NULL pointer dereference flaw was found in the way Jasper versions before \n2.0.26 handled component references in CDEF box in the JP2 image format \ndecoder. A specially crafted JP2 image file could cause an application using \nthe Jasper library to crash when opened (CVE-2021-3467).\n","status":"published","published":"2021-06-13T21:32:39Z","modified":"2026-04-16T04:42:05.414470139Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:13389-1","title":"jasper-4.0.0-2.1 on GA media","description":"These are all security issues fixed in the jasper-4.0.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:56:56.906257Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2022:1475-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- CVE-2021-3467: Fixed NULL pointer deref in jp2_decode() (bsc#1184757). \n- CVE-2021-3443: Fixed NULL pointer deref in jp2_decode() (bsc#1184798).\n- CVE-2021-26927: Fixed NULL pointer deref in jp2_decode() (bsc#1182104).\n- CVE-2021-26926: Fixed an out of bounds read in jp2_decode() (bsc#1182105).\n","status":"published","published":"2022-04-29T15:31:15Z","modified":"2026-02-04T02:36:40.190738Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1479-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- CVE-2021-3467: Fixed NULL pointer deref in jp2_decode() (bsc#1184757). \n- CVE-2021-3443: Fixed NULL pointer deref in jp2_decode() (bsc#1184798).\n- CVE-2021-26927: Fixed NULL pointer deref in jp2_decode() (bsc#1182104).\n- CVE-2021-26926: Fixed an out of bounds read in jp2_decode() (bsc#1182105).\n","status":"published","published":"2022-04-29T15:32:30Z","modified":"2026-02-04T02:30:11.811759Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}