CVE-2011-4517: Canonical Ubuntu Linux

Medium severity, CVSS 6.8. EPSS: 10.5% chance of exploitation in the next 30 days.

The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.

Affected products

• Canonical Ubuntu Linux: version 10.04 only; version 10.10 only; version 11.04 only; version 11.10 only
• Debian Debian Linux: version 6.0 only
• Fedoraproject Fedora: version 15 only; version 16 only
• Jasper Project Jasper: version 1.900.1 only
• Oracle Outside In Technology: version 8.3.5 only; version 8.3.7 only
• Red Hat Enterprise Linux Desktop: version 4 only
• Suse Linux Enterprise Desktop: version 11 only
• Suse Linux Enterprise Server: version 11 only
• Suse Linux Enterprise Software Development Kit: version 11 only

Published 2011-12-15. Last modified 2026-06-16.