MGASA-2021-0113 - Updated jasper packages fix security vulnerability

Publication date: 04 Mar 2021
URL: https://advisories.mageia.org/MGASA-2021-0113.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2021-3272,
     CVE-2021-26926,
     CVE-2021-26927

jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based
buffer over-read when there is an invalid relationship between the number of
channels and the number of image components (CVE-2021-3272).

A flaw was found in jasper. An out of bounds read issue was found in jp2_decode
function which may lead to disclosure of information or program crash
(CVE-2021-26926).

A flaw was found in jasper. A null pointer dereference in jp2_decode in
jp2_dec.c may lead to program crash and denial of service (CVE-2021-26927).

References:
- https://bugs.mageia.org/show_bug.cgi?id=28318
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/HD2Y2LT4N5ZWCMKYCUIKB3XODNJLOW3J/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZSE7IN2V4KAQDTSMRIVDIHQ6XXFC4AUH/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3272
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26926
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26927

SRPMS:
- 7/core/jasper-2.0.25-1.mga7