Mageia 2021-0249: jasper security update
Summary
A NULL pointer dereference flaw was found in the way Jasper versions before
2.0.27 handled component references in the JP2 image format decoder. A
specially crafted JP2 image file could cause an application using the Jasper
library to crash when opened (CVE-2021-3443).
A NULL pointer dereference flaw was found in the way Jasper versions before
2.0.26 handled component references in CDEF box in the JP2 image format
decoder. A specially crafted JP2 image file could cause an application using
the Jasper library to crash when opened (CVE-2021-3467).
References
- https://bugs.mageia.org/show_bug.cgi?id=29017
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KWAIUFNIUCGS2IMGGDTWZIUIY7BNLGKF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6OUXMOIV77VDB6PQ4K2ZRB44DQYYHIXW/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3443
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3467
Resolution
MGASA-2021-0249 - Updated jasper packages fix security vulnerabilities
SRPMS
- 8/core/jasper-2.0.27-1.mga8
- 8/core/mingw-jasper-2.0.27-1.mga8
- 7/core/jasper-2.0.27-1.mga7