CVE-2018-19542

MediumCVSS 6.5/10Last modified Oct 15, 2026

Description

An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading to a denial of service.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.htmlMailing List, Third Party Advisory
https://github.com/mdadams/jasper/issues/182Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00003.htmlMailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00004.htmlMailing List, Third Party Advisory
https://github.com/mdadams/jasper/issues/182Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/01/msg00003.htmlMailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html

Timeline

Published: Nov 26, 2018
Last modified: Oct 15, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-195437.8An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_d CVE-2018-195446.5JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news.CVE-2018-195458.8JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user.CVE-2018-195468.8JTBC(PHP) 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content para CVE-2018-195476.1JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter.CVE-2018-195489.8index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameter CVE-2018-195498.8Interspire Email Marketer through 6.1.6 has SQL Injection via a tagids Delete action to Dynamiccontenttags.php.CVE-2018-195508.8Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, w CVE-2018-195518.8Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttags.php.CVE-2018-195528.8Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid[] request to Dynamiccontenttags.php.CVE-2018-195538.8Interspire Email Marketer through 6.1.6 has SQL Injection via an updateblock sortorder request to Dynamiccontenttags.php CVE-2018-195545.4An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode, identifier, or fieldName parameter in html