UBUNTU-CVE-2020-27828

There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.

References

Affected packages

Ubuntu:16.04:LTS / jasper

Package

Name: jasper
Purl: pkg:deb/ubuntu/jasper@1.900.1-debian1-2.4ubuntu1.3?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.900.1-debian1-2.4ubuntu1.3

Affected versions

1.*

1.900.1-debian1-2.4

1.900.1-debian1-2.4ubuntu1

1.900.1-debian1-2.4ubuntu1.1

1.900.1-debian1-2.4ubuntu1.2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libjasper-dev",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.3"
        },
        {
            "binary_name": "libjasper-runtime",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.3"
        },
        {
            "binary_name": "libjasper-runtime-dbgsym",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.3"
        },
        {
            "binary_name": "libjasper1",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.3"
        },
        {
            "binary_name": "libjasper1-dbgsym",
            "binary_version": "1.900.1-debian1-2.4ubuntu1.3"
        }
    ],
    "availability": "No subscription required"
}