CVE-2020-27828
CVE-2020-27828
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.
CVSS 7.8 · Alta · EPSS 1,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
jasper
- Versiones
- prior to 2.0.23: Afectada
Sin corrección publicada
jasper Ubuntu:16.04:LTS
- Versiones
- 1.900.1-debian1-2.4
- 1.900.1-debian1-2.4ubuntu1
- 1.900.1-debian1-2.4ubuntu1.1
- 1.900.1-debian1-2.4ubuntu1.2
- Intervalos de versiones afectados
- ECOSYSTEM: < 1.900.1-debian1-2.4ubuntu1.3
Actualiza a 1.900.1-debian1-2.4ubuntu1.3
Fuentes originales
- https://bugzilla.redhat.com/show_bug.cgi?id=1905201
- https://github.com/jasper-software/jasper/issues/252
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EBZZ2SNTQ4BSA6PNJCTOAKXIAXYNNF6V/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COBEVDBUO3QTNR6YQBBTIQKNIB6W3MJ2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPOVZTSIQPW2H4AFLMI3LHJEZGBVEQET/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
- https://nvd.nist.gov/vuln/detail/CVE-2020-27828