[arch-security] [ASA-201605-2] jasper: multiple issues

[Levente Polyak]

Arch Linux Security Advisory ASA-201605-2
=========================================

Severity: High
Date    : 2016-05-04
CVE-ID  : CVE-2016-1577 CVE-2016-2089 CVE-2016-2116
Package : jasper
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package jasper before version 1.900.1-15 is vulnerable to multiple
issues including arbitrary code execution and denial of service.

Resolution
==========

Upgrade to 1.900.1-15.

# pacman -Syu "jasper>=1.900.1-15"

The problems have not been fixed upstream but patches were applied.

Workaround
==========

None.

Description
===========

- CVE-2016-1577 (arbitrary code execution)

Double free vulnerability in the jas_iccattrval_destroy function in
JasPer 1.900.1 and earlier allows remote attackers to cause a denial of
service (crash) or possibly execute arbitrary code via a crafted ICC
color profile in a JPEG 2000 image file.

- CVE-2016-2089 (denial of service)

The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows
remote attackers to cause a denial of service (invalid read and
application crash) via a crafted JPEG 2000 image.

- CVE-2016-2116 (denial of service)

Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1
and earlier allows remote attackers to cause a denial of service
(memory consumption) via a crafted ICC color profile in a JPEG 2000
image file.

Impact
======

A remote attacker is able to use a specially crafted image file that,
when processed, is leading to denial of service or arbitrary code
execution.

References
==========

https://bugs.archlinux.org/task/48511
https://access.redhat.com/security/cve/CVE-2016-1577
https://access.redhat.com/security/cve/CVE-2016-2089
https://access.redhat.com/security/cve/CVE-2016-2116

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20160504/09af5493/attachment.asc>