bugtraq - [SECURITY] [DSA 3508-1] jasper security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 06 Mar 2016 15:33:50 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3508-1] jasper security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3508-1                   security@...ian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
March 06, 2016                        https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : jasper
CVE ID         : CVE-2016-1577 CVE-2016-2089 CVE-2016-2116
Debian Bug     : 812978 816625 816626

Several vulnerabilities were discovered in JasPer, a library for
manipulating JPEG-2000 files. The Common Vulnerabilities and Exposures
project identifies the following problems:

CVE-2016-1577

    Jacob Baines discovered a double-free flaw in the
    jas_iccattrval_destroy function. A remote attacker could exploit
    this flaw to cause an application using the JasPer library to crash,
    or potentially, to execute arbitrary code with the privileges of the
    user running the application.

CVE-2016-2089

    The Qihoo 360 Codesafe Team discovered a NULL pointer dereference
    flaw within the jas_matrix_clip function. A remote attacker could
    exploit this flaw to cause an application using the JasPer library
    to crash, resulting in a denial-of-service.

CVE-2016-2116

    Tyler Hicks discovered a memory leak flaw in the
    jas_iccprof_createfrombuf function. A remote attacker could exploit
    this flaw to cause the JasPer library to consume memory, resulting
    in a denial-of-service.

For the oldstable distribution (wheezy), these problems have been fixed
in version 1.900.1-13+deb7u4.

For the stable distribution (jessie), these problems have been fixed in
version 1.900.1-debian1-2.4+deb8u1.

We recommend that you upgrade your jasper packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJW3E20AAoJEAVMuPMTQ89ET6wP/1LssXItmqRgKdtx4cG+Qjmd
vmRnWzDHZvRVKtagSXVZ8C6LJwIutLnT0Zn2wmYZomH37qRJItGIFAYMLfPs6U5H
J0jLJyR8Uk+Vyw6SSCavdUNXaNtMZ1ANb0eG1LAXNIeG5QMrlaP/ww1oJ79qGOkq
90FEoLupFNK+NzpA47RMFDaPJya9jtBe5KbPf2E6B61Jc6Y1/cRhwMfbCyc7nwwc
pAF9oRPPItx4HkBP6b0rOlEBFAdvk8poe5s8B4ExD6eE566ZMs2y46Fwp6PoSAqS
mpErF6TnJbd0huQ6OG1w8Vp/ykMY2V8qvfwMAojliUEajB5giRcke39JJxsiTBsa
iEQNZlBj1+3JPkWP7+DuT0afcXyyMU6Gx7hJgUrVw222cMS2T684Ogk0g+0aokYR
CojLzr+sMuw5Yiwn5sriLR6kko/eLSN0SYV8d56EV3CWmH0U0RbT3zLjFICIh4zU
0xDhDokk6LbAYRipBLWfl569O5RN5yUFfEp24Ne2fhRmsVpxx+ZZPdF/WETj3rIl
fCNZDrJEk8TG/wIauLtBP1WifqP8zFdPCbzAfIonuSJnSndZerRzuMA4ukeBYf/f
acDNzr+7bWfVhs7U5wOI+31Le5gNve6eCRgYjoauLcZkffnsQvq5bdEWiWn5wctD
fXzp23lvqcANMwxMHXlb
=d6L+
-----END PGP SIGNATURE-----