PT-2023-8463 · Jasper+2 · Jasper+2

Pip-Izonyo · Published 2023-12-15 · Updated 2025-11-05 · CVE-2023-51257

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jasper-Software Jasper versions 4.1.1 and earlier

Description The issue is related to an invalid memory write that allows a local attacker to execute arbitrary code. It involves a buffer overflow in memory when handling an ICC profile, specifically related to the jas image decode() function of the JasPer library. This can be exploited to execute arbitrary code.

Recommendations For Jasper-Software Jasper versions 4.1.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-131

CWE-119

Related Identifiers

ALT-PU-2024-2550

AZL-33325

AZL-34807

BDU:2024-00902

CVE-2023-51257

OPENSUSE-SU-2024:13576-1

OPENSUSE-SU-2024_0241-1

ROSA-SA-2025-2649

SUSE-SU-2024:0240-1

SUSE-SU-2024:0241-1

SUSE-SU-2024_0240-1

SUSE-SU-2024_0241-1

SUSE-SU-2025:3947-1

SUSE-SU-2025_3947-1

Affected Products

Alt Linux

Jasper

Suse

References · 34

• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HNTGL7I5IJSQ4BZ5MGKWJPQYICUMHQ5I · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51257 · Security Note
• https://osv.dev/vulnerability/AZL-34807 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MBF5KYWCZVIDMITRX7GBVWGNWKAMQORZ · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:0240-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-51257 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MBF5KYWCZVIDMITRX7GBVWGNWKAMQORZ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HNTGL7I5IJSQ4BZ5MGKWJPQYICUMHQ5I · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:13576-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:3947-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-51257 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-33325 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00902 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:0241-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-51257 · Vendor Advisory