// For flags

CVE-2018-20570

openSUSE Security Advisory - openSUSE-SU-2020:1523-1

Severity Score

6.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

jp2_encode in jp2/jp2_enc.c in JasPer 2.0.14 has a heap-based buffer over-read.

jp2_encode en jp2/jp2_enc.c en JasPer 2.0.14 tiene una sobrelectura de búfer basada en memoria dinámica (heap).

An update that fixes 14 vulnerabilities is now available. This update for jasper fixes the following issues. Improved patch for already fixed issue. Fixed assert in calcstepsizes. Validate component depth bit. Check bounds in jas_seq2d_bindsub. Check bounds in jas_seq2d_bindsub. Check bounds in jas_seq2d_bindsub. Fixed heap base overflow in by checking components. Fixed reachable assertion in jpc_abstorelstepsize. Fixed null pointer deref in ras_putdatastd. Fixed mem leaks by registering jpc_unk_destroyparms. Fixed numchans mixup. Fixed heap based buffer over-read in jp2_encode. Fixed memory leak in jas_malloc.c. This update was imported from the SUSE:SLE-15:Update update project.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-12-28 CVE Reserved
  • 2018-12-28 CVE Published
  • 2024-08-05 CVE Updated
  • 2024-08-05 First Exploit
  • 2025-06-19 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-125: Out-of-bounds Read
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Jasper Project
Search vendor "Jasper Project"
 Jasper
Search vendor "Jasper Project" for product "Jasper"
 2.0.14
Search vendor "Jasper Project" for product "Jasper" and version "2.0.14"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 8.0
Search vendor "Debian" for product "Debian Linux" and version "8.0"
-
Affected