---
id: CVE-2018-19540
title: >-
  An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11,
  1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18,
  1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25,
  1.900.26, 1.900.27, 1.900…
summary: >-
  An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11,
  1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18,
  1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25,
  1.900.26, 1.900.27, 1.900…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-787
vendor: jasper_project
product: jasper
affected:
  - jasper = 2.0.14
  - linux_enterprise_desktop = 12
  - linux_enterprise_server = 11
  - linux_enterprise_server = 12
  - debian_linux = 8.0
published: '2018-11-26'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T18:17:17.263'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2018-19540'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00023.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00025.html'
    label: cve@mitre.org
  - url: 'https://github.com/mdadams/jasper/issues/182'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html'
    label: cve@mitre.org
  - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00023.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00025.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/mdadams/jasper/issues/182'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2019/01/msg00003.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpuapr2020.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-15T17:39:13.173714Z'
epss: 0.02291
epssPercentile: 0.82911
ingestedAt: '2026-10-15T18:23:58.398Z'
---

## Overview

An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer overflow of size 1 in the function jas_icctxtdesc_input in libjasper/base/jas_icc.c.

## Affected

- `jasper = 2.0.14`
- `linux_enterprise_desktop = 12`
- `linux_enterprise_server = 11`
- `linux_enterprise_server = 12`
- `debian_linux = 8.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.