CVE-2021-3467: Null Pointer Dereference
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened.
Other sources
A NULL pointer dereference flaw was reported in Jasper 2.0.25 in the JP2 decoder. The problem is related to insufficient validation of component references from CDEF boxes in the jp2decode() function in src/libjasper/jp2/jp2dec.c.
Upstream issue: https://github.com/jasper-software/jasper/issues/268
Upstream patch: https://github.com/jasper-software/jasper/commit/c4144a6fdb2660794136d1daaa80682ee40b138b
The fix was applied in version 2.0.26.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jasperto a version that resolves this vulnerability.Fixed in 2.0.26 - Upgrade
Upgrade
jasper-software/jasperto a version that resolves this vulnerability.Fixed in 2.0.26
Event History
Frequently Asked Questions
What is CVE-2021-3467?
CVE-2021-3467 is a NULL pointer dereference flaw found in Jasper versions before 2.0.26.
What is the severity of CVE-2021-3467?
CVE-2021-3467 has a severity level of medium.
How does CVE-2021-3467 affect the Jasper software?
CVE-2021-3467 affects the Jasper library, causing it to crash when opening a specially crafted JP2 image file.
Which software versions are affected by CVE-2021-3467?
The versions of Jasper before 2.0.26 are affected by CVE-2021-3467.
Is Fedora affected by CVE-2021-3467?
Yes, Fedora version 34 is affected by CVE-2021-3467.