SUSE-SU-2017:1901-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2017/suse-su-20171901-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:1901-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2017:1901-1

Related

Published

2017-07-19T20:44:00Z

Modified

2017-07-19T20:44:00Z

Summary

Security update for jasper

Details

This update for jasper fixes the following issues:

Security issues fixed: - CVE-2016-9262: Multiple integer overflows in the jasrealloc function in base/jasmalloc.c and memresize function in base/jasstream.c allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities. (bsc#1009994) - CVE-2016-9388: The rasgetcmap function in rasdec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010975) - CVE-2016-9389: The jpcirct and jpciict functions in jpcmct.c allow remote attackers to cause a denial of service (assertion failure). (bsc#1010968) - CVE-2016-9390: The jasseq2dcreate function in jasseq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010774) - CVE-2016-9391: The jpcbitstreamgetbits function in jpcbs.c allows remote attackers to cause a denial of service (assertion failure) via a very large integer. (bsc#1010782) - CVE-2017-1000050: The jp2encode function in jp2_enc.c allows remote attackers to cause a denial of service. (bsc#1047958)

CVEs already fixed with previous update: - CVE-2016-9392: The calcstepsizes function in jpcdec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010757) - CVE-2016-9393: The jpcpinextrpcl function in jpct2cod.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010766) - CVE-2016-9394: The jasseq2dcreate function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010756)

References

Affected packages

SUSE:Linux Enterprise Software Development Kit 11 SP4 / jasper

Package

Name: jasper
Purl: pkg:rpm/suse/jasper&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.900.14-134.33.3.1

Ecosystem specific

{
    "binaries": [
        {
            "libjasper-devel": "1.900.14-134.33.3.1"
        }
    ]
}

SUSE:Linux Enterprise Server 11 SP4 / jasper

Package

Name: jasper
Purl: pkg:rpm/suse/jasper&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.900.14-134.33.3.1

Ecosystem specific

{
    "binaries": [
        {
            "libjasper-32bit": "1.900.14-134.33.3.1",
            "libjasper-x86": "1.900.14-134.33.3.1",
            "libjasper": "1.900.14-134.33.3.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 11 SP4 / jasper

Package

Name: jasper
Purl: pkg:rpm/suse/jasper&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.900.14-134.33.3.1

Ecosystem specific

{
    "binaries": [
        {
            "libjasper-32bit": "1.900.14-134.33.3.1",
            "libjasper-x86": "1.900.14-134.33.3.1",
            "libjasper": "1.900.14-134.33.3.1"
        }
    ]
}