CVE-2020-27828: Input Validation
Heap buffer overflow to out of bounds write in the jpc encoder's cpcreate() routine when resolution levels are greater than max.
Reference: https://github.com/jasper-software/jasper/issues/252
Upstream patch: https://github.com/jasper-software/jasper/pull/253
Other sources
There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this flaw in jasper's jpc encoder?
The vulnerability ID for this flaw in jasper's jpc encoder is CVE-2020-27828.
What is the severity of CVE-2020-27828?
CVE-2020-27828 has a severity rating of 7.8 (high).
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by providing crafted input to jasper's jpc encoder, causing an arbitrary out-of-bounds write.
Which versions of jasper are affected by this vulnerability?
Versions of jasper prior to 2.0.23 are affected by this vulnerability.
How can I fix this vulnerability in jasper's jpc encoder?
To fix this vulnerability, upgrade jasper to version 2.0.23 or later.