CVE-2024-31744
Fixed in a distro release EPSS <1%CVSS 7.5
In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing attackers to cause a denial of service attack through a specific image file.
Products: jasper_project jasper
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Enterprise Storage 7.1 | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP5 | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise Server 12 SP5 | jasper | 1.900.14-195.40.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | jasper | 1.900.14-195.40.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | jasper | 2.0.14-150000.3.34.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | jasper | 1.900.14-195.40.1 |
| SUSE Manager Proxy 4.3 | jasper | 2.0.14-150000.3.34.1 |
| SUSE Manager Server 4.3 | jasper | 2.0.14-150000.3.34.1 |
| Ubuntu 16.04 LTS | jasper | no fix |
| openSUSE Leap 15.5 | jasper | 2.0.14-150000.3.34.1 |
| openSUSE Tumbleweed | jasper | 4.2.3-2.1 |