CVE-2020-27828

Published: 11 December 2020

There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.

Priority

CVSS 3 base score: 7.8

Status

Package	Release	Status
jasper Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	groovy	Does not exist
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (2.0.23)
	xenial	Released (1.900.1-debian1-2.4ubuntu1.3)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27828
https://ubuntu.com/security/notices/USN-4688-1
NVD
Launchpad
Debian

Bugs

https://github.com/jasper-software/jasper/issues/252

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›