CVE-2025-8837 | Medium | 5.3 | 2025-08-11 | A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000… |
CVE-2025-8836 | Low | 3.3 | 2025-08-11 | A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the compo… |
CVE-2025-8835 | Low | 3.3 | 2025-08-11 | A vulnerability was found in JasPer up to 4.2.5. Affected by this vulnerability is the function jas_image_chclrspc of the file src/libjasper/base/jas_image.c o… |
CVE-2023-51257 | High | 7.8 | 2024-01-16 | An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code. |
CVE-2022-2963 | High | 7.5 | 2022-10-14 | A vulnerability found in jasper. This security vulnerability happens because of a memory leak bug in function cmdopts_parse that can cause a crash or segmentat… |
CVE-2022-40755 | Medium | 5.5 | 2022-09-16 | JasPer 3.0.6 allows denial of service via a reachable assertion in the function inttobits in libjasper/base/jas_image.c. |
CVE-2021-27845 | Medium | 5.5 | 2021-07-15 | A Divide-by-zero vulnerability exists in JasPer Image Coding Toolkit 2.0 in jasper/src/libjasper/jpc/jpc_enc.c |
CVE-2021-3467 | Medium | 5.5 | 2021-03-25 | A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A… |
CVE-2021-3443 | Medium | 5.5 | 2021-03-25 | A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially cr… |
CVE-2021-26927 | Medium | 5.5 | 2021-02-23 | A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service. |
CVE-2021-26926 | High | 7.1 | 2021-02-23 | A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program cr… |
CVE-2021-3272 | Medium | 5.5 | 2021-01-27 | jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channel… |
CVE-2020-27828 | High | 7.8 | 2020-12-11 | There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds writ… |
CVE-2015-8751 | High | 8.8 | 2020-02-17 | Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPEG 2000 image, relat… |
CVE-2017-14232 | Medium | 5.5 | 2019-08-15 | The read_chunk function in flif-dec.cpp in Free Lossless Image Format (FLIF) 0.3 allows remote attackers to cause a denial of service (invalid memory read and… |
CVE-2018-20622 | Medium | 6.5 | 2018-12-31 | JasPer 2.0.14 has a memory leak in base/jas_malloc.c in libjasper.a when "--output-format jp2" is used. |
CVE-2018-20584 | Medium | 6.5 | 2018-12-30 | JasPer 2.0.14 allows remote attackers to cause a denial of service (application hang) via an attempted conversion to the jp2 format. |
CVE-2018-20570 | Medium | 6.5 | 2018-12-28 | jp2_encode in jp2/jp2_enc.c in JasPer 2.0.14 has a heap-based buffer over-read. |
CVE-2018-19543 | High | 7.8 | 2018-11-26 | An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c. |
CVE-2018-19542 | Medium | 6.5 | 2018-11-26 | An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading to a denial of ser… |
CVE-2018-19541 | High | 8.8 | 2018-11-26 | An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.2… |
CVE-2018-19540 | High | 8.8 | 2018-11-26 | An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.2… |
CVE-2018-19539 | Medium | 6.5 | 2018-11-26 | An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, leading to a denial of… |
CVE-2018-19139 | Medium | 5.5 | 2018-11-09 | An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getparms in jpc_cs.c. |
CVE-2018-18873 | Medium | 5.5 | 2018-10-31 | An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c. |
CVE-2016-9583 | Medium | 5.5 | 2018-08-01 | An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input. |
CVE-2016-8654 | High | 7.8 | 2018-08-01 | A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size. jasper versions before 2.0.0 are… |
CVE-2018-9154 | High | 7.5 | 2018-05-04 | There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack… |
CVE-2018-9252 | Medium | 6.5 | 2018-04-04 | JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c. |
CVE-2018-9055 | Medium | 5.5 | 2018-03-27 | JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c. |
CVE-2016-9600 | Medium | 6.5 | 2018-03-12 | JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file c… |
CVE-2016-9591 | Medium | 5.5 | 2018-03-09 | JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application usin… |
CVE-2017-14229 | High | 7.5 | 2017-09-09 | There is an infinite loop in the jpc_dec_tileinit function in jpc/jpc_dec.c of Jasper 2.0.13. It will lead to a remote denial of service attack. |
CVE-2017-14132 | Medium | 6.5 | 2017-09-04 | JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.90… |
CVE-2017-13752 | High | 7.5 | 2017-08-29 | There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack. |
CVE-2017-13751 | High | 7.5 | 2017-08-29 | There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack. |
CVE-2017-13750 | High | 7.5 | 2017-08-29 | There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer 2.0.12 that will lead to a remote denial of service… |
CVE-2017-13749 | High | 7.5 | 2017-08-29 | There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack. |
CVE-2017-13748 | High | 7.5 | 2017-08-29 | There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote denial of service atta… |
CVE-2017-13747 | High | 7.5 | 2017-08-29 | There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12 that will lead to a remote denial of service attack. |
CVE-2017-13746 | High | 7.5 | 2017-08-29 | There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer 2.0.12 that will lead to a remote denial of service… |
CVE-2017-13745 | High | 7.5 | 2017-08-29 | There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attac… |
CVE-2015-5203 | Medium | 5.5 | 2017-08-02 | Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted… |
CVE-2015-5221 | Medium | 5.5 | 2017-07-25 | Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers… |
CVE-2017-1000050 | High | 7.5 | 2017-07-17 | JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component r… |
CVE-2017-9782 | Medium | 5.5 | 2017-06-21 | JasPer 2.0.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, related to the jp2_… |
CVE-2016-8884 | Medium | 5.5 | 2017-03-28 | The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by callin… |
CVE-2016-9557 | Medium | 5.5 | 2017-03-23 | Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file. |
CVE-2016-9399 | High | 7.5 | 2017-03-23 | The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors. |
CVE-2016-9398 | High | 7.5 | 2017-03-23 | The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vec… |
CVE-2016-9397 | High | 7.5 | 2017-03-23 | The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors. |
CVE-2016-9396 | High | 7.5 | 2017-03-23 | The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) v… |
CVE-2016-9395 | Medium | 5.5 | 2017-03-23 | The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (assertion failure) via a crafted fil… |
CVE-2016-9394 | Medium | 5.5 | 2017-03-23 | The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted fil… |
CVE-2016-9393 | Medium | 5.5 | 2017-03-23 | The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted fi… |
CVE-2016-9392 | Medium | 5.5 | 2017-03-23 | The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. |
CVE-2016-9391 | High | 7.5 | 2017-03-23 | The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very larg… |
CVE-2016-9390 | Medium | 5.5 | 2017-03-23 | The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted ima… |
CVE-2016-9389 | High | 7.5 | 2017-03-23 | The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure). |
CVE-2016-9388 | Medium | 5.5 | 2017-03-23 | The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image fi… |
CVE-2016-9387 | High | 7.8 | 2017-03-23 | Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact vi… |
CVE-2016-9262 | Medium | 5.5 | 2017-03-23 | Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allo… |
CVE-2016-8887 | Medium | 5.5 | 2017-03-23 | The jp2_colr_destroy function in libjasper/jp2/jp2_cod.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (NULL pointer dereferen… |
CVE-2016-8886 | High | 7.8 | 2017-03-23 | The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers to have unspecified impact via a crafted file, which t… |
CVE-2016-8885 | Medium | 5.5 | 2017-03-23 | The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by… |
CVE-2017-5505 | Medium | 5.5 | 2017-03-16 | The jas_matrix_asl function in jas_seq.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted… |
CVE-2017-6852 | High | 7.8 | 2017-03-15 | Heap-based buffer overflow in the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer 2.0.10 allows remote attackers to have unspecified impact via a crafted i… |
CVE-2017-6851 | Medium | 5.5 | 2017-03-15 | The jas_matrix_bindsub function in jas_seq.c in JasPer 2.0.10 allows remote attackers to cause a denial of service (invalid read) via a crafted image. |
CVE-2017-6850 | Medium | 5.5 | 2017-03-15 | The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafte… |
CVE-2016-10251 | High | 7.8 | 2017-03-15 | Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file… |
CVE-2016-10250 | High | 7.5 | 2017-03-15 | The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dereference) by leverag… |
CVE-2016-10249 | High | 7.8 | 2017-03-15 | Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impact via a crafted ima… |
CVE-2016-10248 | High | 7.5 | 2017-03-15 | The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vec… |
CVE-2017-5504 | Medium | 5.5 | 2017-03-01 | The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) vi… |
CVE-2017-5503 | Medium | 5.5 | 2017-03-01 | The dec_clnpass function in libjasper/jpc/jpc_t1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory write and crash)… |
CVE-2017-5502 | Medium | 5.5 | 2017-03-01 | libjasper/jp2/jp2_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value. |
CVE-2017-5501 | Medium | 5.5 | 2017-03-01 | Integer overflow in libjasper/jpc/jpc_tsfb.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file. |
CVE-2017-5500 | Medium | 5.5 | 2017-03-01 | libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value. |
CVE-2017-5499 | Medium | 5.5 | 2017-03-01 | Integer overflow in libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file. |
CVE-2017-5498 | Medium | 5.5 | 2017-03-01 | libjasper/include/jasper/jas_math.h in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negat… |
CVE-2016-9560 | High | 7.8 | 2017-02-15 | Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a… |
CVE-2016-8693 | High | 7.8 | 2017-02-15 | Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or p… |
CVE-2016-8692 | Medium | 5.5 | 2017-02-15 | The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error… |
CVE-2016-8691 | Medium | 5.5 | 2017-02-15 | The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error… |
CVE-2016-8690 | Medium | 5.5 | 2017-02-15 | The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) vi… |
CVE-2016-8883 | Medium | 5.5 | 2017-01-13 | The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted fi… |
CVE-2016-8882 | Medium | 5.5 | 2017-01-13 | The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL pointer dereferenc… |
CVE-2016-2116 | Medium | 5.7 | 2016-04-13 | Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (memory consumption) v… |
CVE-2016-1577 | High | 7.6 | 2016-04-13 | Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or… |
CVE-2016-2089 | Medium | 6.5 | 2016-02-08 | The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a cra… |
CVE-2016-1867 | Medium | 6.5 | 2016-01-20 | The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JP… |
CVE-2014-8158 | | | 2015-01-26 | Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execu… |
CVE-2014-8157 | | | 2015-01-26 | Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly exe… |
CVE-2014-8138 | | | 2014-12-24 | Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly ex… |
CVE-2014-8137 | | | 2014-12-24 | Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or… |
CVE-2014-9029 | | | 2014-12-08 | Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote… |
CVE-2011-4517 | | | 2011-12-15 | The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote at… |
CVE-2011-4516 | | | 2011-12-15 | Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code o… |
CVE-2008-3522 | | | 2008-10-02 | Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown i… |
CVE-2008-3521 | | | 2008-10-02 | Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exi… |