MGASA-2021-0113 - Updated jasper packages fix security vulnerability

Publication date: 04 Mar 2021
Type: security
Affected Mageia releases: 7
CVE: CVE-2021-3272,

jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based
buffer over-read when there is an invalid relationship between the number of
channels and the number of image components (CVE-2021-3272).

A flaw was found in jasper. An out of bounds read issue was found in jp2_decode
function which may lead to disclosure of information or program crash

A flaw was found in jasper. A null pointer dereference in jp2_decode in
jp2_dec.c may lead to program crash and denial of service (CVE-2021-26927).

-[email protected]/thread/HD2Y2LT4N5ZWCMKYCUIKB3XODNJLOW3J/
-[email protected]/thread/ZSE7IN2V4KAQDTSMRIVDIHQ6XXFC4AUH/

- 7/core/jasper-2.0.25-1.mga7