CVE-2018-19139

MediumCVSS 5.5/10Last modified Oct 15, 2026

Description

An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getparms in jpc_cs.c.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-772

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html
http://www.securityfocus.com/bid/105956Third Party Advisory, VDB Entry
https://github.com/mdadams/jasper/issues/188Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00003.htmlMailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html
http://www.securityfocus.com/bid/105956Third Party Advisory, VDB Entry
https://github.com/mdadams/jasper/issues/188Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00003.htmlMailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html

Timeline

Published: Nov 9, 2018
Last modified: Oct 15, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-19145.4IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed CVE-2018-191414.8Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL be CVE-2018-191424.8Open Ticket Request System (OTRS) 6.0.x before 6.0.13 allows an admin to conduct an XSS attack via a modified URL.CVE-2018-191436.5Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete f CVE-2018-191456.1An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter.CVE-2018-191464.8Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT CVE-2018-191483.7Caddy through 0.11.0 sends incorrect certificates for certain invalid requests, making it easier for attackers to enumerate hostnames. Speci CVE-2018-191496.5Poppler before 0.70.0 has a NULL pointer dereference in _poppler_attachment_new when called from poppler_annot_file_attachment_get_attachmen CVE-2018-191507.8Memory corruption in PDMODELProvidePDModelHFT in pdmodel.dll in pdfforge PDF Architect 6 allows remote attackers to cause a denial of servic CVE-2018-191517.5qtum through 0.16 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blocks CVE-2018-191527.5emercoin through 0.7 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blo CVE-2018-191537.5particl through 0.17 (a chain-based proof-of-stake cryptocurrency) allows a remote denial of service. The attacker sends invalid headers/blo