CVE-2020-27828

Published: 11 December 2020

There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.

Priority

CVSS 3 base score: 7.8

Status

Package	Release	Status
jasper Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	groovy	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (2.0.23)
	xenial	Released (1.900.1-debian1-2.4ubuntu1.3)
	Patches: other: https://github.com/jasper-software/jasper/pull/253 upstream: https://github.com/jasper-software/jasper/commit/4cd52b5daac62b00a0a328451544807ddecf775f

References

Bugs

https://github.com/jasper-software/jasper/issues/252

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Security