Alerts This Week
Warning Icon 1 924
Alerts This Week
Warning Icon 1 924

Mageia 7, 8 Advisory: 2021-0249 Moderate: Jasper Pointer Issue

mageia
Calendar Grey June 13, 2021
Dist Mageia Esm H88
Revised software for Jasper addresses significant issues in processing JP2 files to avert program failures.
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder

Summary

A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened (CVE-2021-3443).
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened (CVE-2021-3467).

References

- https://bugs.mageia.org/show_bug.cgi?id=29017

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KWAIUFNIUCGS2IMGGDTWZIUIY7BNLGKF/

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6OUXMOIV77VDB6PQ4K2ZRB44DQYYHIXW/

- https://www.cve.org/CVERecord?id=CVE-2021-3443

- https://www.cve.org/CVERecord?id=CVE-2021-3467

Topics%20covered

Topics Covered

security advisory moderate severity application crash Mageia JP2 image NULL pointer crash Jasper library

Resolution

SRPMS

- 8/core/jasper-2.0.27-1.mga8

- 8/core/mingw-jasper-2.0.27-1.mga8

- 7/core/jasper-2.0.27-1.mga7

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 13 Jun 2021
URL: https://advisories.mageia.org/MGASA-2021-0249.html
Type: security
CVE: CVE-2021-3443, CVE-2021-3467

Topics%20covered

Topics Covered

security advisory moderate severity application crash Mageia JP2 image NULL pointer crash Jasper library

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here