CVE-2018-19539 — jasper: access violation in jas_image_readcmpt() in jas_image.c

Back Back to CVE browser

MEDIUM

jasper: access violation in jas_image_readcmpt() in jas_image.c

Published Nov 26, 2018

6.5

MEDIUM

CVSS 3.0

EPSS 1.95%

Description

An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, leading to a denial of service.

Affected products

Red Hat Enterprise Linux 5

netpbm

Not affected
Red Hat Enterprise Linux 6

jasper

Will not fix
Red Hat Enterprise Linux 7

jasper

Fix deferred
Red Hat Enterprise Linux 8

jasper

Fix deferred
Red Hat Enterprise Linux 8

mingw-jasper

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	netpbm	Not affected	n/a
Red Hat Enterprise Linux 6	jasper	Will not fix	n/a
Red Hat Enterprise Linux 7	jasper	Fix deferred	n/a
Red Hat Enterprise Linux 8	jasper	Fix deferred	n/a
Red Hat Enterprise Linux 8	mingw-jasper	Fix deferred	n/a

Remediation

Red Hat statement

This vulnerability was rated as LOW severity because it requires the victim to open a specially crafted file. While it doesn’t allow full system compromise, it can cause the application to crash temporarily.

Metrics

1.95% 0.01946

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.01946

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (15 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	1.95% (0.01946)	79.49th	v5 (v2026.06.15)
Jun 15, 2026	1.95% (0.01946)	77.48th	v5 (v2026.06.15)
Mar 30, 2025	1.02% (0.01019)	75.21th	v4 (v2025.03.14)
Mar 29, 2025	2.11% (0.02106)	73.46th	v4 (v2025.03.14)
Mar 17, 2025	1.02% (0.01019)	75.68th	v4 (v2025.03.14)
Dec 12, 2024	0.19% (0.00189)	57.65th	v3 (v2023.03.01)
Apr 18, 2024	0.19% (0.00189)	55.84th	v3 (v2023.03.01)
Feb 8, 2024	0.27% (0.00266)	66.69th	v3 (v2023.03.01)
Nov 19, 2023	0.27% (0.00266)	64.07th	v3 (v2023.03.01)
Sep 3, 2023	0.32% (0.00317)	66.65th	v3 (v2023.03.01)
Mar 7, 2023	0.45% (0.00450)	71.15th	v3 (v2023.03.01)
Mar 6, 2023	1.02% (0.01018)	40.69th	v2 (v2022.01.01)
Feb 4, 2022	1.02% (0.01018)	19.50th	v2 (v2022.01.01)
Feb 3, 2022	1.29% (0.01294)	30.79th	v5 (v2026.06.15)
Apr 14, 2021	1.29% (0.01294)	0.00th	v1

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-617

References (8)

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html
vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2018-19539
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1658773
Issue Tracking
https://github.com/mdadams/jasper/issues/182
x_refsource_MISCExploitThird Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html
mailing-listx_refsource_MLISTThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-19539
https://www.cve.org/CVERecord?id=CVE-2018-19539
https://www.oracle.com/security-alerts/cpuapr2020.html
x_refsource_MISC

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html		vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2018-19539		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1658773		Issue Tracking
https://github.com/mdadams/jasper/issues/182		x_refsource_MISCExploitThird Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html		mailing-listx_refsource_MLISTThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-19539
https://www.cve.org/CVERecord?id=CVE-2018-19539
https://www.oracle.com/security-alerts/cpuapr2020.html		x_refsource_MISC