CVE-2020-27828
HIGH
Published Dec 11, 20205y ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
Published Dec 11, 2020 5y ago
Last Modified Jun 17, 2026 1w ago
Description
There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
Public Exploit Known
Patch Available
Weaknesses 1
CWE-20 Improper Input Validation Validation
Affected Products 3
| Vendor | Product | Version | Range |
|---|---|---|---|
| jasper_project | jasper | * | <2.0.23 |
| fedoraproject | fedora | 32 | any |
| fedoraproject | fedora | 33 | any |
References 6
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1905201
- github.com https://github.com/jasper-software/jasper/issues/252
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/COBEVDBUO3QTNR6YQBBTIQKNIB6W3MJ2/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EBZZ2SNTQ4BSA6PNJCTOAKXIAXYNNF6V/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UPOVZTSIQPW2H4AFLMI3LHJEZGBVEQET/
Remediation
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1905201