Arch Linux Security Advisory ASA-201612-9 ========================================= Severity: Critical Date : 2016-12-07 CVE-ID : CVE-2015-5203 CVE-2015-8751 CVE-2016-2089 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692 CVE-2016-8693 CVE-2016-8884 CVE-2016-8885 CVE-2016-8887 CVE-2016-9262 CVE-2016-9387 CVE-2016-9388 CVE-2016-9557 CVE-2016-9560 Package : jasper Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jasper before version 1.900.31-1 is vulnerable to multiple issues including arbitrary code execution and denial of service. Resolution ========== Upgrade to 1.900.31-1. # pacman -Syu "jasper>=1.900.31-1" The problems have been fixed upstream in version 1.900.31. Workaround ========== None. Description =========== - CVE-2015-5203 (arbitrary code execution) A double free flaw was found in the way JasPer's jasper_image_stop_load() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or possibly execute arbitrary code. - CVE-2015-8751 (denial of service) An integer overflow flaw was found in the way the JasPer's library jas_matrix_create() function parsed certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. - CVE-2016-2089 (denial of service) The jas_matrix_clip function in jas_seq.c allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image. - CVE-2016-8690 (denial of service) A null pointer dereference vulnerability was found in bmp_getdata triggered by invoking imginfo command on specially crafted BMP image. - CVE-2016-8691 (denial of service) A division by zero vulnerability was found in jpc_dec_process_siz triggered by invoking imginfo command on specially crafted file. - CVE-2016-8692 (denial of service) A division by zero vulnerability was found in jpc_dec_process_siz triggered by invoking imginfo command on specially crafted file. - CVE-2016-8693 (denial of service) A double free vulnerability was found in mem_close in jas_stream.c triggered by invoking imginfo command on specially crafted image file. - CVE-2016-8884 (denial of service) A null pointer dereference vulnerability has been discovered in bmp_getdata in bmp_dec.c. - CVE-2016-8885 (denial of service) A null pointer dereference vulnerability has been discovered in bmp_getdata in bmp_dec.c. - CVE-2016-8887 (denial of service) A null pointer dereference vulnerability was found in jp2_colr_destroy in jp2_cod.c leading to application crash. - CVE-2016-9262 (arbitrary code execution) A number of overflows were found in jasper causing use after free vulnerability triggered by a crafted image. - CVE-2016-9387 (denial of service) An integer overflow in jpc_dec_process_siz was found that can be triggered by crafted image file when given as input to imginfo. - CVE-2016-9388 (denial of service) An improper error handling was found in the RAS encoder/decoder triggering assertion tests that result in denial of service. - CVE-2016-9557 (denial of service) A signed integer overflow vulnerability has been discovered in jas_image.c triggered by a crafted image. An option max_samples has been added to the BMP and JPEG decoders to restrict the maximum size of image that they can decode. This change was made as a (possibly temporary) fix to address security concerns. - CVE-2016-9560 (arbitrary code execution) A stack buffer overflow vulnerability has been discovered in jpc/jpc_dec.c duo to an out of bounds array write triggered by a crafted image. Impact ====== A remote attacker is able to perform a denial of service attack or execute arbitrary code on the affected host. References ========== http://seclists.org/oss-sec/2015/q3/366 https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c3 http://seclists.org/oss-sec/2016/q1/44 https://bugzilla.redhat.com/show_bug.cgi?id=1294039 http://www.openwall.com/lists/oss-security/2016/10/16/14 https://blogs.gentoo.org/ago/2016/10/16/jasper-two-null-pointer-dereference-... https://github.com/mdadams/jasper/commit/8f62b4761711d036fd8964df256b938c809... https://github.com/mdadams/jasper/commit/d8c2604cd438c41ec72aff52c16ebd81830... https://github.com/mdadams/jasper/commit/44a524e367597af58d6265ae2014468b334... https://github.com/mdadams/jasper/commit/5d66894d2313e3f3469f19066 http://seclists.org/oss-sec/2016/q4/213 https://github.com/mdadams/jasper/commit/e24bdc716c3327b067c551bc6cfb97fd237... http://seclists.org/oss-sec/2016/q4/215 https://github.com/mdadams/jasper/commit/634ce8e8a5accc0fa05dd2 http://seclists.org/oss-sec/2016/q4/385 https://github.com/mdadams/jasper/commit/d91198abd00fc435a397fe6bad906a4c174... http://seclists.org/oss-sec/2016/q4/441 https://github.com/mdadams/jasper/commit/411a4068f8c464e883358bf403a3e251588... https://github.com/mdadams/jasper/commit/d42b2388f7f8e0332c846675133acea151f... http://www.openwall.com/lists/oss-security/2016/11/23/2 https://github.com/mdadams/jasper/commit/1abc2e5a401a4bf1d5ca4df91358ce5df11... http://www.openwall.com/lists/oss-security/2016/11/23/5 https://access.redhat.com/security/cve/CVE-2015-5203 https://access.redhat.com/security/cve/CVE-2015-8751 https://access.redhat.com/security/cve/CVE-2016-2089 https://access.redhat.com/security/cve/CVE-2016-8690 https://access.redhat.com/security/cve/CVE-2016-8691 https://access.redhat.com/security/cve/CVE-2016-8692 https://access.redhat.com/security/cve/CVE-2016-8693 https://access.redhat.com/security/cve/CVE-2016-8884 https://access.redhat.com/security/cve/CVE-2016-8885 https://access.redhat.com/security/cve/CVE-2016-8887 https://access.redhat.com/security/cve/CVE-2016-9262 https://access.redhat.com/security/cve/CVE-2016-9387 https://access.redhat.com/security/cve/CVE-2016-9388 https://access.redhat.com/security/cve/CVE-2016-9557 https://access.redhat.com/security/cve/CVE-2016-9560