SUSE-SU-2018:0339-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:0339-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2018:0339-1
Related
Published
2018-02-01T15:36:00Z
Modified
2018-02-01T15:36:00Z
Summary
Security update for jasper
Details

This update for jasper fixes the following issues:

Security issues fixed: - CVE-2016-9262: Multiple integer overflows in the jasrealloc function in base/jasmalloc.c and memresize function in base/jasstream.c allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities. (bsc#1009994) - CVE-2016-9388: The rasgetcmap function in rasdec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010975) - CVE-2016-9389: The jpcirct and jpciict functions in jpcmct.c allow remote attackers to cause a denial of service (assertion failure). (bsc#1010968) - CVE-2016-9390: The jasseq2dcreate function in jasseq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (bsc#1010774) - CVE-2016-9391: The jpcbitstreamgetbits function in jpcbs.c allows remote attackers to cause a denial of service (assertion failure) via a very large integer. (bsc#1010782) - CVE-2017-1000050: The jp2encode function in jp2_enc.c allows remote attackers to cause a denial of service. (bsc#1047958)

CVEs already fixed with previous update: - CVE-2016-9392: The calcstepsizes function in jpcdec.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010757) - CVE-2016-9393: The jpcpinextrpcl function in jpct2cod.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010766) - CVE-2016-9394: The jasseq2dcreate function in jas_seq.c allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (bsc#1010756)

References

Affected packages

SUSE:Linux Enterprise Desktop 12 SP3 / jasper

Package

Name
jasper
Purl
purl:rpm/suse/jasper&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.900.14-195.5.1

Ecosystem specific 

{
    "binaries": [
        {
            "libjasper1": "1.900.14-195.5.1",
            "libjasper1-32bit": "1.900.14-195.5.1"
        }
    ]
}

SUSE:Linux Enterprise Software Development Kit 12 SP3 / jasper

Package

Name
jasper
Purl
purl:rpm/suse/jasper&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.900.14-195.5.1

Ecosystem specific 

{
    "binaries": [
        {
            "libjasper-devel": "1.900.14-195.5.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP3 / jasper

Package

Name
jasper
Purl
purl:rpm/suse/jasper&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.900.14-195.5.1

Ecosystem specific 

{
    "binaries": [
        {
            "libjasper1": "1.900.14-195.5.1",
            "libjasper1-32bit": "1.900.14-195.5.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP3 / jasper

Package

Name
jasper
Purl
purl:rpm/suse/jasper&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.900.14-195.5.1

Ecosystem specific 

{
    "binaries": [
        {
            "libjasper1": "1.900.14-195.5.1",
            "libjasper1-32bit": "1.900.14-195.5.1"
        }
    ]
}