ArchLinux: 201612-9: jasper: multiple issues
Summary
- CVE-2015-5203 (arbitrary code execution)
A double free flaw was found in the way JasPer's
jasper_image_stop_load() function parsed certain JPEG 2000 image files.
A specially crafted file could cause an application using JasPer to
crash or possibly execute arbitrary code.
- CVE-2015-8751 (denial of service)
An integer overflow flaw was found in the way the JasPer's library
jas_matrix_create() function parsed certain JPEG 2000 image files. A
specially crafted file could cause an application using JasPer to
crash.
- CVE-2016-2089 (denial of service)
The jas_matrix_clip function in jas_seq.c allows remote attackers to
cause a denial of service (invalid read and application crash) via a
crafted JPEG 2000 image.
- CVE-2016-8690 (denial of service)
A null pointer dereference vulnerability was found in bmp_getdata
triggered by invoking imginfo command on specially crafted BMP image.
- CVE-2016-8691 (denial of service)
A division by zero vulnerability was found in jpc_dec_process_siz
triggered by invoking imginfo command on specially crafted file.
- CVE-2016-8692 (denial of service)
A division by zero vulnerability was found in jpc_dec_process_siz
triggered by invoking imginfo command on specially crafted file.
- CVE-2016-8693 (denial of service)
A double free vulnerability was found in mem_close in jas_stream.c
triggered by invoking imginfo command on specially crafted image file.
- CVE-2016-8884 (denial of service)
A null pointer dereference vulnerability has been discovered in
bmp_getdata in bmp_dec.c.
- CVE-2016-8885 (denial of service)
A null pointer dereference vulnerability has been discovered in
bmp_getdata in bmp_dec.c.
- CVE-2016-8887 (denial of service)
A null pointer dereference vulnerability was found in jp2_colr_destroy
in jp2_cod.c leading to application crash.
- CVE-2016-9262 (arbitrary code execution)
A number of overflows were found in jasper causing use after free
vulnerability triggered by a crafted image.
- CVE-2016-9387 (denial of service)
An integer overflow in jpc_dec_process_siz was found that can be
triggered by crafted image file when given as input to imginfo.
- CVE-2016-9388 (denial of service)
An improper error handling was found in the RAS encoder/decoder
triggering assertion tests that result in denial of service.
- CVE-2016-9557 (denial of service)
A signed integer overflow vulnerability has been discovered in
jas_image.c triggered by a crafted image. An option max_samples has
been added to the BMP and JPEG decoders to restrict the maximum size of
image that they can decode. This change was made as a (possibly
temporary) fix to address security concerns.
- CVE-2016-9560 (arbitrary code execution)
A stack buffer overflow vulnerability has been discovered in
jpc/jpc_dec.c duo to an out of bounds array write triggered by a
crafted image.
Resolution
Upgrade to 1.900.31-1.
# pacman -Syu "jasper>=1.900.31-1"
The problems have been fixed upstream in version 1.900.31.
References
https://seclists.org/oss-sec/2015/q3/366 https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c3 https://seclists.org/oss-sec/2016/q1/44 https://bugzilla.redhat.com/show_bug.cgi?id=1294039 http://www.openwall.com/lists/oss-security/2016/10/16/14 https://blogs.gentoo.org/ago/2016/10/16/jasper-two-null-pointer-dereference-in-bmp_getdata-bmp_dec-c/ https://github.com/jasper-software/jasper/commit/8f62b4761711d036fd8964df256b938c809b7fca https://github.com/jasper-software/jasper/commit/d8c2604cd438c41ec72aff52c16ebd8183068020 https://github.com/mdadams/jasper/commit/44a524e367597af58d6265ae2014468b334d0309 https://github.com/jasper-software/jasper/commit/5d66894d2313e3f3469f19066 https://seclists.org/oss-sec/2016/q4/213 https://github.com/jasper-software/jasper/commit/e24bdc716c3327b067c551bc6cfb97fd2370358d https://seclists.org/oss-sec/2016/q4/215 https://github.com/jasper-software/jasper/commit/634ce8e8a5accc0fa05dd2 https://seclists.org/oss-sec/2016/q4/385 https://github.com/jasper-software/jasper/commit/d91198abd00fc435a397fe6bad906a4c1748e9cf https://seclists.org/oss-sec/2016/q4/441 https://github.com/jasper-software/jasper/commit/411a4068f8c464e883358bf403a3e25158863823 https://github.com/jasper-software/jasper/commit/d42b2388f7f8e0332c846675133acea151fc557a http://www.openwall.com/lists/oss-security/2016/11/23/2 https://github.com/jasper-software/jasper/commit/1abc2e5a401a4bf1d5ca4df91358ce5df111f495 http://www.openwall.com/lists/oss-security/2016/11/23/5 https://access.redhat.com/security/cve/CVE-2015-5203 https://access.redhat.com/security/cve/CVE-2015-8751 https://access.redhat.com/security/cve/CVE-2016-2089 https://access.redhat.com/security/cve/CVE-2016-8690 https://access.redhat.com/security/cve/CVE-2016-8691 https://access.redhat.com/security/cve/CVE-2016-8692 https://access.redhat.com/security/cve/CVE-2016-8693 https://access.redhat.com/security/cve/CVE-2016-8884 https://access.redhat.com/security/cve/CVE-2016-8885 https://access.redhat.com/security/cve/CVE-2016-8887 https://access.redhat.com/security/cve/CVE-2016-9262 https://access.redhat.com/security/cve/CVE-2016-9387 https://access.redhat.com/security/cve/CVE-2016-9388 https://access.redhat.com/security/cve/CVE-2016-9557 https://access.redhat.com/security/cve/CVE-2016-9560
Workaround
None.
