openSUSE Security Update : jasper (openSUSE-2016-1309)

Critical Nessus Plugin ID 94945


The remote openSUSE host is missing a security update.


This update for jasper to version 1.900.14 fixes several issues.

These security issues were fixed :

- CVE-2016-8887: NULL pointer dereference in jp2_colr_destroy (jp2_cod.c) (bsc#1006836)

- CVE-2016-8886: memory allocation failure in jas_malloc (jas_malloc.c) (bsc#1006599)

- CVE-2016-8884,CVE-2016-8885: two NULL pointer dereferences in bmp_getdata (incomplete fix for CVE-2016-8690) (bsc#1007009)

- CVE-2016-8883: assert in jpc_dec_tiledecode() (bsc#1006598)

- CVE-2016-8882: segfault / NULL pointer access in jpc_pi_destroy (bsc#1006597)

- CVE-2016-8881: Heap overflow in jpc_getuint16() (bsc#1006593)

- CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox() (bsc#1006591)

- CVE-2016-8693 Double free vulnerability in mem_close (bsc#1005242)

- CVE-2016-8691, CVE-2016-8692: Divide by zero in jpc_dec_process_siz (bsc#1005090)

- CVE-2016-8690: NULL pointer dereference in bmp_getdata triggered by crafted BMP image (bsc#1005084)

- CVE-2016-2116: Memory leak in the jas_iccprof_createfrombuf function in JasPer allowed remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file (bsc#968373)

- CVE-2016-2089: invalid read in the JasPer's jas_matrix_clip() function (bsc#963983)

- CVE-2016-1867: Out-of-bounds Read in the JasPer's jpc_pi_nextcprl() function (bsc#961886)

- CVE-2015-5221: Use-after-free (and double-free) in Jasper JPEG-200 (bsc#942553).

- CVE-2015-5203: Double free corruption in JasPer JPEG-2000 implementation (bsc#941919)

- CVE-2008-3522: Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer might have allowed context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (bsc#392410)

- jasper: NULL pointer dereference in jp2_colr_destroy (jp2_cod.c) (incomplete fix for CVE-2016-8887) (bsc#1006839)

For additional change description please have a look at the changelog.

This update was imported from the SUSE:SLE-12:Update update project.


Update the affected jasper packages.

See Also

Plugin Details

Severity: Critical

ID: 94945

File Name: openSUSE-2016-1309.nasl

Version: $Revision: 2.3 $

Type: local

Agent: unix

Published: 2016/11/18

Modified: 2017/02/27

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C


Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:jasper, p-cpe:/a:novell:opensuse:jasper-debuginfo, p-cpe:/a:novell:opensuse:jasper-debugsource, p-cpe:/a:novell:opensuse:libjasper-devel, p-cpe:/a:novell:opensuse:libjasper1, p-cpe:/a:novell:opensuse:libjasper1-32bit, p-cpe:/a:novell:opensuse:libjasper1-debuginfo, p-cpe:/a:novell:opensuse:libjasper1-debuginfo-32bit, cpe:/o:novell:opensuse:42.1, cpe:/o:novell:opensuse:42.2

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2016/11/17

Reference Information

CVE: CVE-2008-3522, CVE-2014-8158, CVE-2015-5203, CVE-2015-5221, CVE-2016-1577, CVE-2016-1867, CVE-2016-2089, CVE-2016-2116, CVE-2016-8690, CVE-2016-8691, CVE-2016-8692, CVE-2016-8693, CVE-2016-8880, CVE-2016-8881, CVE-2016-8882, CVE-2016-8883, CVE-2016-8884, CVE-2016-8885, CVE-2016-8886, CVE-2016-8887

CWE: 119