CVE catalog

CVE-2025-8835

Security update for jasper

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published: Aug 11, 2025, 7:15:00 AM UTC
Updated: Apr 22, 2026, 4:12:30 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.23% · Oct 25, 2026

A vulnerability was found in JasPer up to 4.2.5. Affected by this vulnerability is the function jas_image_chclrspc of the file src/libjasper/base/jas_image.c of the component Image Color Space Conversion Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52. It is recommended to apply a patch to fix this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Ubuntu	jasper	16.04	`1.900.1-debian1-2.4`	vulnerable
Ubuntu	jasper	16.04	`1.900.1-debian1-2.4ubuntu1`	vulnerable
Ubuntu	jasper	16.04	`1.900.1-debian1-2.4ubuntu1.1`	vulnerable
Ubuntu	jasper	16.04	`1.900.1-debian1-2.4ubuntu1.2`	vulnerable
Ubuntu	jasper	16.04	`1.900.1-debian1-2.4ubuntu1.3`	vulnerable
Opensuse	jasper	leap 16.0	`4.2.8-160000.1.1`	fixed
Opensuse	jasper	tumbleweed	`4.2.8-2.1`	fixed
Suse	jasper	linux enterprise server 16.0	`4.2.8-160000.1.1`	fixed
Suse	jasper	linux enterprise server for sap applications 16.0	`4.2.8-160000.1.1`	fixed
Suse	jasper	linux enterprise module for basesystem 15 sp6	`2.0.14-150000.3.37.1`	fixed
Suse	jasper	linux enterprise module for basesystem 15 sp7	`2.0.14-150000.3.37.1`	fixed
Suse	jasper	linux enterprise module for desktop applications 15 sp6	`4.2.8-150600.4.5.1`	fixed
Suse	jasper	linux enterprise module for desktop applications 15 sp7	`4.2.8-150600.4.5.1`	fixed
Opensuse	jasper	leap 15.6	`4.2.8-150600.4.5.1`	fixed
Suse	jasper	linux enterprise server ltss extended security 12 sp5	`1.900.14-195.43.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Opensuse	jasper	rpm	leap 16.0	`4.2.8-160000.1.1`	Not reported	OPENSUSE-SU-2026:20138-1	Not reported
Opensuse	jasper	rpm	tumbleweed	`4.2.8-2.1`	Not reported	OPENSUSE-SU-2025:15447-1	Not reported
Suse	jasper	rpm	linux enterprise server 16.0	`4.2.8-160000.1.1`	Not reported	SUSE-SU-2026:20200-1	Not reported
Suse	jasper	rpm	linux enterprise server for sap applications 16.0	`4.2.8-160000.1.1`	Not reported	SUSE-SU-2026:20200-1	Not reported
Suse	jasper	rpm	linux enterprise module for basesystem 15 sp6	`2.0.14-150000.3.37.1`	Not reported	SUSE-SU-2025:03219-1	Not reported
Suse	jasper	rpm	linux enterprise module for basesystem 15 sp7	`2.0.14-150000.3.37.1`	Not reported	SUSE-SU-2025:03219-1	Not reported
Suse	jasper	rpm	linux enterprise module for desktop applications 15 sp6	`4.2.8-150600.4.5.1`	Not reported	SUSE-SU-2025:3947-1	Not reported
Suse	jasper	rpm	linux enterprise module for desktop applications 15 sp7	`4.2.8-150600.4.5.1`	Not reported	SUSE-SU-2025:3947-1	Not reported
Opensuse	jasper	rpm	leap 15.6	`4.2.8-150600.4.5.1`	Not reported	SUSE-SU-2025:3947-1	Not reported
Suse	jasper	rpm	linux enterprise server ltss extended security 12 sp5	`1.900.14-195.43.1`	Not reported	SUSE-SU-2025:03367-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libjasper7]Unknown
Source package: [jasper]
Details (1)
- 4.2.9-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 4.2.8-2.1
  Version impact unknown
  pypi · jasper · opensuse · tumbleweed
[libjasper7-32bit]Unknown
Source package: [jasper]
Details (1)
- 4.2.9-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 4.2.8-2.1
  Version impact unknown
  pypi · jasper · opensuse · tumbleweed
[libjasper-devel]Unknown
Source package: [jasper]
Details (1)
- 4.2.9-1.4 · x86_64 · tumbleweed
  Unknown · Fixed: 4.2.8-2.1
  Version impact unknown
  pypi · jasper · opensuse · tumbleweed
[jasper]Fixed
Source package: [jasper]
Details (1)
- 4.2.9-1.4 · x86_64 · tumbleweed
  Fixed · Fixed: 4.2.8-2.1
  pypi · jasper · opensuse · tumbleweed

Observed: Oct 24, 2026, 8:25:45 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]