CVE-2021-3272

jp2decode in jp2/jp2dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components.

References

Affected packages

Git / github.com/mdadams/jasper

Affected ranges

Type: GIT
Repo: https://github.com/mdadams/jasper
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

9a2835a81ce9c41a48f36dadce79f110da8d6c75

Affected versions

Other

mdadams-clang-issue

version-1.*

version-1.900.1

version-1.900.10

version-1.900.11

version-1.900.12

version-1.900.13

version-1.900.14

version-1.900.15

version-1.900.16

version-1.900.17

version-1.900.18

version-1.900.19

version-1.900.2

version-1.900.20

version-1.900.21

version-1.900.22

version-1.900.23

version-1.900.24

version-1.900.25

version-1.900.26

version-1.900.27

version-1.900.28

version-1.900.29

version-1.900.3

version-1.900.30

version-1.900.31

version-1.900.4

version-1.900.5

version-1.900.6

version-1.900.7

version-1.900.8

version-1.900.9

version-2.*

version-2.0.0

version-2.0.0-beta.1

version-2.0.0-beta.2

version-2.0.1

version-2.0.10

version-2.0.11

version-2.0.12

version-2.0.13

version-2.0.14

version-2.0.15

version-2.0.16

version-2.0.19

version-2.0.2

version-2.0.20

version-2.0.21

version-2.0.21-rc1

version-2.0.22

version-2.0.22-rc1

version-2.0.23

version-2.0.24

version-2.0.3

version-2.0.4

version-2.0.5

version-2.0.6

version-2.0.7

version-2.0.8

version-2.0.9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-3272.json"