CVE-2021-3443: 
NixOS vulnerability analysis and mitigation

A NULL pointer dereference vulnerability (CVE-2021-3443) was discovered in Jasper versions before 2.0.27. The vulnerability affects the way Jasper handles component references in the JP2 image format decoder. This security issue was reported on March 15, 2021, and affects all versions of Jasper prior to version 2.0.27 (NVD, Red Hat Bugzilla).

The vulnerability is a NULL pointer dereference flaw in the jp2decode function within jp2dec.c of the Jasper library. The issue first became exploitable in version 2.0.20, though the underlying problem existed in earlier versions as well. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability allows an attacker to cause an application using the Jasper library to crash when opening a specially crafted JP2 image file, resulting in a denial of service condition (Red Hat Bugzilla).

The vulnerability was fixed in Jasper version 2.0.27. Users are advised to upgrade to this version or later to address the security issue. The fix was implemented through a patch that can be found in the upstream repository (Red Hat Bugzilla).