A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.
References
| Link | Resource |
|---|---|
| https://drive.google.com/file/d/17Ic_DDOlH7mMT7IbTN2Bmo6SrujIUh24/view?usp=sharing | Exploit |
| https://github.com/jasper-software/jasper/commit/8308060d3fbc1da10353ac8a95c8ea60eba9c25a | Patch |
| https://github.com/jasper-software/jasper/issues/402 | Exploit Issue Tracking Vendor Advisory |
| https://vuldb.com/?ctiid.319371 | Permissions Required VDB Entry |
| https://vuldb.com/?id.319371 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.630487 | Exploit Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.630488 | Exploit Third Party Advisory VDB Entry |
| https://github.com/jasper-software/jasper/issues/402 | Exploit Issue Tracking Vendor Advisory |
| https://vuldb.com/?submit.630488 | Exploit Third Party Advisory VDB Entry |
Configurations
History
16 Sep 2025, 18:55
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:jasper_project:jasper:*:*:*:*:*:*:*:* | |
| First Time |
Jasper Project
Jasper Project jasper |
|
| References | () https://drive.google.com/file/d/17Ic_DDOlH7mMT7IbTN2Bmo6SrujIUh24/view?usp=sharing - Exploit | |
| References | () https://github.com/jasper-software/jasper/commit/8308060d3fbc1da10353ac8a95c8ea60eba9c25a - Patch | |
| References | () https://github.com/jasper-software/jasper/issues/402 - Exploit, Issue Tracking, Vendor Advisory | |
| References | () https://vuldb.com/?ctiid.319371 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.319371 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.630487 - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.630488 - Exploit, Third Party Advisory, VDB Entry | |
| Summary | (es) Se identificó una vulnerabilidad en JasPer hasta la versión 4.2.5. Esta afecta a la función jpc_dec_dump del archivo src/libjasper/jpc/jpc_dec.c del componente JPEG2000 File Handler. La manipulación provoca el use after free. Un ataque debe abordarse localmente. Se ha hecho público el exploit y puede que sea utilizado. El parche se denomina 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. Se recomienda aplicar un parche para solucionar este problema. |
11 Aug 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/jasper-software/jasper/issues/402 - | |
| References | () https://vuldb.com/?submit.630488 - |
11 Aug 2025, 18:32
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
11 Aug 2025, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-11 08:15
Updated : 2025-09-16 18:55
NVD link : CVE-2025-8837
Mitre link : CVE-2025-8837
CVE.ORG link : CVE-2025-8837
JSON object : View
Products Affected
jasper_project
- jasper