CVE-2022-2963 Denial of service in jasper

High 7.5 Published 14 Oct 2022 Updated 15 May 2025

A memory leak in the Jasper library's command-line parser can cause application crashes, leading to denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-2963?

CVE-2022-2963 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 14 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability found in jasper. This security vulnerability happens because of a memory leak bug in function cmdopts_parse that can cause a crash or segmentation fault.

Weakness: CWE-401

Which versions are affected by CVE-2022-2963?

It affects 3 products.

Linux distribution packages (10)

`jasper` SUSE:Linux Enterprise Module for Basesystem 15 SP3	All versions	`2.0.14-150000.3.28.1`
`jasper` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`2.0.14-150000.3.28.1`
`jasper` SUSE:Linux Enterprise Module for Desktop Applications 15 SP3	All versions	`2.0.14-150000.3.28.1`
`jasper` SUSE:Linux Enterprise Module for Desktop Applications 15 SP4	All versions	`2.0.14-150000.3.28.1`
`jasper` SUSE:Linux Enterprise Server 12 SP5	All versions	`1.900.14-195.34.1`
`jasper` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`1.900.14-195.34.1`
`jasper` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`1.900.14-195.34.1`
`jasper` openSUSE:Leap 15.3	All versions	`2.0.14-150000.3.28.1`
`jasper` openSUSE:Leap 15.4	All versions	`2.0.14-150000.3.28.1`
`jasper` openSUSE:Tumbleweed	All versions	`3.0.6-2.1`

Products include Fedoraproject Fedora, Jasper Project Jasper, Redhat Enterprise Linux.

How do I fix CVE-2022-2963?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-2963 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2963 exists.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as CLSA-2026-1792566014, GHSA-g89h-fpvv-hmhh, MGASA-2023-0091, SUSE-SU-2022:3672-1, SUSE-SU-2022:3673-1, UBUNTU-CVE-2022-2963 and 1 more.