PT-2024-3317 · Jasper+1 · Jasper+1

Arbuszo · Published 2024-04-19 · Updated 2024-08-19 · CVE-2024-31744

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Jasper version 4.2.2

Description The issue is related to an assertion failure vulnerability in the jpc streamlist remove function, which can be exploited by attackers to cause a denial of service attack through a specific image file. This vulnerability is associated with incorrect cleanup or release of resources.

Recommendations For Jasper version 4.2.2, consider disabling the jpc streamlist remove function as a temporary workaround until a patch is available. Restrict access to the jpc dec.c module to minimize the risk of exploitation. Avoid using the vulnerable function with specially crafted image files until the issue is resolved.

Fix

DoS

Assertion Failure

Improper Resource Release

Weakness Enumeration

CWE-617

CWE-404

Related Identifiers

AZL-40000

BDU:2024-03555

CVE-2024-31744

MGASA-2024-0144

OPENSUSE-SU-2024:13878-1

OPENSUSE-SU-2024_1464-1

SUSE-SU-2024:1396-1

SUSE-SU-2024:1464-1

SUSE-SU-2024_1396-1

SUSE-SU-2024_1464-1

Affected Products

Jasper

Suse

References · 22

• https://osv.dev/vulnerability/openSUSE-SU-2024:13878-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0144 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-31744 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-31744 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:1396-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-31744 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-40000 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31744 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03555 · Security Note
• https://advisories.mageia.org/MGASA-2024-0144.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:1464-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-31744 · Vendor Advisory
• https://github.com/jasper-software/jasper/issues/381 · Note
• https://github.com/jasper-software/jasper/commit/6d084c53a77762f41bb5310713a5f1872fef55f5 · Note
• https://suse.com/support/update/announcement/2024/suse-su-20241464-1 · Note