Heap based overflow in jasicctxtdescinput (CVE-2018-19540).
Heap based overread in jasimagedepalettize (CVE-2018-19541).