7 Mar
2016
7 Mar
'16
11:58 a.m.
On 07-03-16 10:55, Harrison Wells wrote:
Is the package JasPer in extra repo vulnerable to CVE-2016-1577, CVE-2016-2089 and CVE-2016-2116? I noticed that the version number of JasPer is same in Debian, Ubuntu and Arch, i.e. 1.900.1. Debian and Ubuntu seem to have updated/patched it, is Arch not vulnerable to it?
With regards,
Harrison Wells The most recent added patch appears to be jasper-1.900.1-CVE-2015-5203 . I suggest you report this to arch-security mailinglist, https://lists.archlinux.org/listinfo/arch-security LW