SUSE-SU-2025:03367-1: jasper&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 SUSE Linux Enterprise
Vulnerability summary
SUSE-SU-2025:03367-1 is a vulnerability in jasper&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 SUSE Linux Enterprise with no CVSS score yet.
Advisory lineage
Upstream 3 · Downstream 0 · Related 3Timeline
- 26-09-2025PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
Security update for jasper This update for jasper fixes the following issues: - CVE-2025-8835: missing range check in the JPEG-2000 (JPC) Encoder leads to assertion failure and crash when processing a malformed JPEG2000 image with an invalid `cblkwidth` parameter (bsc#1247904). - CVE-2025-8836: out-of-bounds array indexing in function `jas_image_chclrspc` leads to crash when processing a malformed image file with BMP output format and color space conversion (bsc#1247902). - CVE-2025-8837: missing operations in cleanup code of the JPEG-2000 (JPC) Encoder leads to use-after-free when processing malformed JPEG2000 images with certain debug levels enabled (bsc#1247901).
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Suse1 product
- jasper&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5< 1.900.14-195.43.1
1 vendor · 1 product