CVE-2018-9154
Fixed in a distro release EPSS 3%
There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack by triggering an unexpected jas_alloc2 return value, a different vulnerability than CVE-2017-13745.
Products: jasper_project jasper
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Module for Basesystem 15 SP1 | jasper | 2.0.14-3.11.8 |
| SUSE Linux Enterprise Module for Basesystem 15 SP2 | jasper | 2.0.14-3.11.8 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP1 | jasper | 2.0.14-3.11.8 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP2 | jasper | 2.0.14-3.11.8 |
| SUSE Linux Enterprise Module for Package Hub 15 SP1 | jasper | 2.0.14-3.11.8 |
| SUSE Linux Enterprise Server 12 SP5 | jasper | 1.900.14-195.22.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | jasper | 1.900.14-195.22.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | jasper | 1.900.14-195.22.1 |
| Ubuntu 16.04 LTS | jasper | no fix |
| openSUSE Leap 15.1 | jasper | 2.0.14-lp151.4.6.1 |
| openSUSE Tumbleweed | jasper | 2.0.33-1.2 |