CVE-2020-27828: 
NixOS vulnerability analysis and mitigation

CVE-2020-27828 is a security vulnerability discovered in JasPer's JPC encoder affecting versions prior to 2.0.23. The vulnerability was identified as a heap-based buffer overflow in the cp_create() function within the jpc_enc.c file (NVD, RedHat Bugzilla).

The vulnerability occurs when resolution levels are set above the maximum allowed value in the JPC encoder's cp_create() routine. The flaw is primarily caused by improper input validation where the provided rlvl value is trusted by default. When processing images with crafted rlvl input, the resolution levels could exceed the maximum limit, leading to a heap buffer overflow near 'tccp->prcwidthexpns[rlvlno] = prcwidthexpn' in the cp_create() function. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD, GitHub Issue).

The vulnerability could potentially affect data confidentiality, integrity, and application availability. Since both prcwidthexpn and prcheightexpn can be controlled by data obtained from crafted input, it creates potential for exploitation through arbitrary writes (RedHat Bugzilla).

The vulnerability can be triggered by providing crafted input to Jasper with resolution levels (numrlvls) greater than 36. When exploited, it attempts to write to tccp->prcheightexpns[35], causing a heap-buffer-overflow-write (GitHub Issue).

The vulnerability was fixed in JasPer version 2.0.23. For systems unable to update immediately, the flaw can be mitigated by not accepting untrusted inputs to be processed by Jasper or constraining rlevels on those inputs from outside of Jasper (RedHat Bugzilla).