CVE-2018-19542 - jasper: invalid access in jp2_decode in libjasper/jp2/jp2_dec.c

Back Back to CVE browser

MEDIUM

jasper: invalid access in jp2_decode in libjasper/jp2/jp2_dec.c

Published Nov 26, 2018

6.5

MEDIUM

CVSS 3.0

EPSS 1.95%

Description

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading to a denial of service.

Affected products

Red Hat Enterprise Linux 5

netpbm

Not affected
Red Hat Enterprise Linux 6

jasper

Will not fix
Red Hat Enterprise Linux 7

jasper

Fix deferred
Red Hat Enterprise Linux 8

jasper

Fix deferred
Red Hat Enterprise Linux 8

mingw-jasper

Fix deferred

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	netpbm	Not affected	n/a
Red Hat Enterprise Linux 6	jasper	Will not fix	n/a
Red Hat Enterprise Linux 7	jasper	Fix deferred	n/a
Red Hat Enterprise Linux 8	jasper	Fix deferred	n/a
Red Hat Enterprise Linux 8	mingw-jasper	Fix deferred	n/a

Remediation

Red Hat statement

This vulnerability was rated as LOW severity because it requires the victim to open a specially crafted file, it doesn't allow full system compromise, it can cause the application to crash temporarily.

Weaknesses (1)

CWE-476

NULL Pointer Dereference

References (9)

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html
vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2018-19542
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1658791
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11231
Advisory
https://github.com/mdadams/jasper/issues/182
x_refsource_MISCExploitThird Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-19542
https://www.cve.org/CVERecord?id=CVE-2018-19542
https://www.oracle.com/security-alerts/cpuapr2020.html
x_refsource_MISC

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.html		vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2018-19542		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1658791		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11231		Advisory
https://github.com/mdadams/jasper/issues/182		x_refsource_MISCExploitThird Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-19542
https://www.cve.org/CVERecord?id=CVE-2018-19542
https://www.oracle.com/security-alerts/cpuapr2020.html		x_refsource_MISC