Ubuntu 11.10 USN-1315-1 Medium: jasper Remote Code Execution Risk

ubuntu

December 20, 2011

JasPer could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

JasPer could be made to crash or run programs as your login if it opened a

specially crafted file.

Software Description:

- jasper: Library for manipulating JPEG-2000 files

Details:

Jonathan Foote discovered that JasPer incorrectly handled certain malformed

JPEG-2000 image files. If a user were tricked into opening a specially

crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash

or possibly execute arbitrary code with user privileges.

Topics Covered

security advisory remote code execution ubuntu medium jasper

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  libjasper1                      1.900.1-7ubuntu2.11.10.1

Ubuntu 11.04:
  libjasper1                      1.900.1-7ubuntu2.11.04.1

Ubuntu 10.10:
  libjasper1                      1.900.1-7ubuntu0.10.10.1

Ubuntu 10.04 LTS:
  libjasper1                      1.900.1-7ubuntu0.10.04.1

In general, a standard system update will make all the necessary changes.