Arch Linux Security Advisory ASA-201605-2
========================================
Severity: High
Date    : 2016-05-04
CVE-ID  : CVE-2016-1577 CVE-2016-2089 CVE-2016-2116
Package : jasper
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package jasper before version 1.900.1-15 is vulnerable to multiple
issues including arbitrary code execution and denial of service.

Resolution
=========
Upgrade to 1.900.1-15.

# pacman -Syu "jasper>=1.900.1-15"

The problems have not been fixed upstream but patches were applied.

Workaround
=========
None.

Description
==========
- CVE-2016-1577 (arbitrary code execution)

Double free vulnerability in the jas_iccattrval_destroy function in
JasPer 1.900.1 and earlier allows remote attackers to cause a denial of
service (crash) or possibly execute arbitrary code via a crafted ICC
color profile in a JPEG 2000 image file.

- CVE-2016-2089 (denial of service)

The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows
remote attackers to cause a denial of service (invalid read and
application crash) via a crafted JPEG 2000 image.

- CVE-2016-2116 (denial of service)

Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1
and earlier allows remote attackers to cause a denial of service
(memory consumption) via a crafted ICC color profile in a JPEG 2000
image file.

Impact
=====
A remote attacker is able to use a specially crafted image file that,
when processed, is leading to denial of service or arbitrary code
execution.

References
=========
https://bugs.archlinux.org/task/48511
https://access.redhat.com/security/cve/CVE-2016-1577
https://access.redhat.com/security/cve/CVE-2016-2089
https://access.redhat.com/security/cve/CVE-2016-2116