CVE-2021-3467
Fixed in a distro release EPSS <1%
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
Products: jasper_project jasper, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | jasper | 1.900.1-33.amzn2.0.1 |
| Amazon Linux 2 | jasper-devel | 1.900.1-33.amzn2.0.1 |
| Amazon Linux 2 | jasper-libs | 1.900.1-33.amzn2.0.1 |
| Amazon Linux 2 | jasper-utils | 1.900.1-33.amzn2.0.1 |
| Arch Linux | jasper | 2.0.27-1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | jasper | 2.0.14-150000.3.25.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP3 | jasper | 2.0.14-150000.3.25.1 |
| SUSE Linux Enterprise Real Time 15 SP2 | jasper | 2.0.14-150000.3.25.1 |
| SUSE Linux Enterprise Server 12 SP5 | jasper | 1.900.14-195.31.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | jasper | 1.900.14-195.31.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | jasper | 1.900.14-195.31.1 |
| Ubuntu 16.04 LTS | jasper | no fix |
| openSUSE Leap 15.3 | jasper | 2.0.14-150000.3.25.1 |
| openSUSE Leap 15.4 | jasper | 2.0.14-150000.3.25.1 |
| openSUSE Tumbleweed | jasper | 4.0.0-2.1 |