CVE-2011-4517
Fixed in a distro release EPSS 10%
The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.
Products: jasper_project jasper, oracle outside_in_technology, canonical ubuntu_linux, debian_linux, fedoraproject fedora, suse linux_enterprise_desktop, suse linux_enterprise_server, suse linux_enterprise_software_development_kit, redhat enterprise_linux_desktop
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | jasper | 1.900.5-1 |
| Debian 12 | ghostscript | 8.64~dfsg-2 |
| Debian 13 | ghostscript | 8.64~dfsg-2 |
| Debian 14 | ghostscript | 8.64~dfsg-2 |
| Debian 5.0 | jasper | 1.900.1-5.1+lenny2 |
| Debian 6.0 | jasper | 1.900.1-7+squeeze1 |
| Red Hat Enterprise Linux 4 | netpbm | 0:10.35.58-8.el4 |
| Red Hat Enterprise Linux 4 | netpbm-debuginfo | 0:10.35.58-8.el4 |
| Red Hat Enterprise Linux 4 | netpbm-devel | 0:10.35.58-8.el4 |
| Red Hat Enterprise Linux 4 | netpbm-progs | 0:10.35.58-8.el4 |
| Red Hat Enterprise Linux 5 | netpbm | 0:10.35.58-8.el5_7.3 |
| Red Hat Enterprise Linux 5 | netpbm-debuginfo | 0:10.35.58-8.el5_7.3 |
| Red Hat Enterprise Linux 5 | netpbm-devel | 0:10.35.58-8.el5_7.3 |
| Red Hat Enterprise Linux 5 | netpbm-progs | 0:10.35.58-8.el5_7.3 |
| Red Hat Enterprise Linux 6 | jasper | 0:1.900.1-15.el6_1.1 |
| Red Hat Enterprise Linux 6 | jasper-debuginfo | 0:1.900.1-15.el6_1.1 |
| Red Hat Enterprise Linux 6 | jasper-devel | 0:1.900.1-15.el6_1.1 |
| Red Hat Enterprise Linux 6 | jasper-libs | 0:1.900.1-15.el6_1.1 |
| Red Hat Enterprise Linux 6 | jasper-utils | 0:1.900.1-15.el6_1.1 |
| Red Hat rhev manager 3 | rhevm-spice-client | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x64-cab | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x64-msi | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x86-cab | 0:3.5-3.el6 |
| Red Hat rhev manager 3 | rhevm-spice-client-x86-msi | 0:3.5-3.el6 |
| openSUSE Tumbleweed | jasper | 1.900.14-3.1 |