{"id":"CVE-2024-31744","aliases":["AZL-40000","EUVD-2024-29617","GHSA-4pvq-mcwh-v9jc","MGASA-2024-0144","SUSE-SU-2024:1396-1","SUSE-SU-2024:1464-1","UBUNTU-CVE-2024-31744","openSUSE-SU-2024:13878-1"],"status":"published","title":"In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an...","description":"In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00737,"percentile":0.54834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2024-04-19T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"jasper","fixed_in":["4.2.1-2"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"jasper","fixed_in":["3.0.6-1.1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"jasper","fixed_in":["1.900.14-195.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"jasper","fixed_in":["1.900.14-195.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"jasper","fixed_in":["1.900.14-195.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"jasper","fixed_in":["2.0.14-150000.3.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"jasper","fixed_in":["4.2.3-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-2"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.6-1.1.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.900.14-195.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.14-150000.3.34.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.900.1-debian1-2.4","1.900.1-debian1-2.4ubuntu1","1.900.1-debian1-2.4ubuntu1.1","1.900.1-debian1-2.4ubuntu1.2","1.900.1-debian1-2.4ubuntu1.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jasper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-2.1"}]}]}],"products":[{"vendor":"jasper_project","product":"jasper"}],"references":[{"url":"https://github.com/jasper-software/jasper/issues/381","tags":["x_transferred","report"]},{"url":"https://github.com/jasper-software/jasper/commit/6d084c53a77762f41bb5310713a5f1872fef55f5","tags":["x_transferred","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31744","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4pvq-mcwh-v9jc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31744.json","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0144.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33134","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241396-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223155","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31744","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241464-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-31744","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31744","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-31744","description":"In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.","status":"published","published":"2024-04-19T00:00:00Z","modified":"2024-08-02T01:59:49.964Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-29617","description":"In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.","status":"published","published":"2024-04-19T00:00:00Z","modified":"2024-08-02T01:59:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:24.06764Z"}],"ghsa":[{"id":"GHSA-4pvq-mcwh-v9jc","title":"In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an...","description":"In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.","status":"published","published":"2024-04-19T15:30:46Z","modified":"2024-07-03T18:36:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:57:34.303632Z"}],"nvd":[{"id":"CVE-2024-31744","description":"In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.","status":"published","published":"2024-04-19T13:15:13.5Z","modified":"2026-06-17T07:28:42.13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:09:53.50104Z"}],"osv":[{"id":"CVE-2024-31744","description":"In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.","status":"published","published":"2024-04-19T00:00:00Z","modified":"2026-10-28T10:43:43.580604456Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"UBUNTU-CVE-2024-31744","description":"In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.","status":"published","published":"2024-04-19T13:15:00Z","modified":"2026-04-22T14:48:57.093417Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"AZL-40000","title":"CVE-2024-31744 affecting package jasper for versions less than 4.2.1-2","description":"In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.","status":"published","published":"2024-04-19T13:15:13Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.751978Z"},{"id":"MGASA-2024-0144","title":"Updated jasper packages fix security vulnerability","description":"CVE-2024-31744: Fixed denial of service through assertion failure in\njpc_streamlist_remove()\n","status":"published","published":"2024-04-25T16:00:30Z","modified":"2026-04-16T04:44:30.725258964Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13878-1","title":"jasper-4.2.3-2.1 on GA media","description":"These are all security issues fixed in the jasper-4.2.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:49:17.524123Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:1396-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- CVE-2024-31744: Fixed denial of service through assertion failure in jpc_streamlist_remove() (bsc#1223155).\n","status":"published","published":"2024-04-23T11:03:40Z","modified":"2026-02-04T02:56:06.198392Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1464-1","title":"Security update for jasper","description":"This update for jasper fixes the following issues:\n\n- CVE-2024-31744: Fixed denial of service through assertion failure in jpc_streamlist_remove() (bsc#1223155).\n","status":"published","published":"2024-04-29T12:14:22Z","modified":"2026-02-04T03:56:50.959749Z","updated_at":"2026-11-02T15:53:54.652421Z"}]}}