There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack.
www.securityfocus.com/bid/100514
bugzilla.redhat.com/show_bug.cgi?id=1485283
lists.fedoraproject.org/archives/list/[email protected]/message/N4ALB4SXHURLVWKAOKYRNJXPABW3M22M/
lists.fedoraproject.org/archives/list/[email protected]/message/UPOVZTSIQPW2H4AFLMI3LHJEZGBVEQET/
security.gentoo.org/glsa/201908-03