CVE-2021-26927: 
NixOS vulnerability analysis and mitigation

A null pointer dereference vulnerability was discovered in JasPer versions before 2.0.25, identified as CVE-2021-26927. The vulnerability exists in the jp2_decode function within jp2_dec.c file of the JasPer image processing library (NVD, GitHub Issue).

The vulnerability occurs in the jp2_decode function when processing JPEG 2000 images. The issue arises when the decoder attempts to process a JP2 file with inconsistent values for the number of components and/or component types, which can lead to a null pointer dereference. The vulnerability has a CVSS v3.1 Base Score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can lead to program crash and denial of service. The impact is limited to availability, with no direct impact on confidentiality or integrity of the system (NVD).

The vulnerability can be triggered by processing a specially crafted JP2 image file. A proof of concept (PoC) exploit has been published demonstrating the null pointer access in jp2_decode when running jasper with specific JP2 files (GitHub Issue).

The vulnerability has been fixed in JasPer version 2.0.25 and later. The fix involves modifying the JP2 decoder to treat inconsistent component values as hard errors rather than warnings, preventing the null pointer dereference condition (GitHub Commit). Users are advised to upgrade to version 2.0.25 or later.

The vulnerability was addressed in various Linux distributions including Fedora 32, 33, and 34, which released security updates to patch the vulnerability (Fedora Update).