An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c.

References

• report https://github.com/mdadams/jasper/issues/182
• web http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00082.html
• web http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00085.html
• web https://www.oracle.com/security-alerts/cpuapr2020.html