Security update for jasper SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0258-1 Final 1 1 2015-02-03T13:44:10Z current 2015-02-03T13:44:10Z 2015-02-03T13:44:10Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for jasper This update for jasper fixes the following security issues: * CVE-2014-8137: Double free in jas_iccattrval_destroy(). Double call to free() allowed attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. (bsc#909474) * CVE-2014-8138: Heap overflow in jas_decode(). This could be used to do an arbitrary write and could result in arbitrary code execution. (bsc#909475) * CVE-2014-8157: Off-by-one error in the jpc_dec_process_sot(). Could allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow. (bsc#911837) * CVE-2014-8158: Multiple stack-based buffer overflows in jpc_qmfb.c. Could allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image. (bsc#911837) Security Issues: * CVE-2014-8138 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8138> * CVE-2014-8137 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8137> * CVE-2014-8157 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8157> * CVE-2014-8158 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8158> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-jasper,sledsp3-jasper,slessp3-jasper Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150258-1/ Link for SUSE-SU-2015:0258-1 https://lists.suse.com/pipermail/sle-security-updates/2015-February/001216.html E-Mail link for SUSE-SU-2015:0258-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/909474 SUSE Bug 909474 https://bugzilla.suse.com/909475 SUSE Bug 909475 https://bugzilla.suse.com/911837 SUSE Bug 911837 https://www.suse.com/security/cve/CVE-2014-8137/ SUSE CVE CVE-2014-8137 page https://www.suse.com/security/cve/CVE-2014-8138/ SUSE CVE CVE-2014-8138 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP3 libjasper-devel-1.900.1-134.17.1 libjasper-1.900.1-134.17.1 libjasper-32bit-1.900.1-134.17.1 libjasper-x86-1.900.1-134.17.1 libjasper-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 libjasper-32bit-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 libjasper-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Server 11 SP3 libjasper-32bit-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Server 11 SP3 libjasper-x86-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Server 11 SP3 libjasper-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libjasper-32bit-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libjasper-x86-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA libjasper-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libjasper-32bit-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libjasper-x86-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 libjasper-devel-1.900.1-134.17.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file. CVE-2014-8137 SUSE Linux Enterprise Desktop 11 SP3:libjasper-1.900.1-134.17.1 SUSE Linux Enterprise Desktop 11 SP3:libjasper-32bit-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libjasper-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libjasper-32bit-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libjasper-x86-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3:libjasper-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3:libjasper-32bit-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3:libjasper-x86-1.900.1-134.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libjasper-1.900.1-134.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libjasper-32bit-1.900.1-134.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libjasper-x86-1.900.1-134.17.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libjasper-devel-1.900.1-134.17.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150258-1/ https://www.suse.com/security/cve/CVE-2014-8137.html CVE-2014-8137 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 https://bugzilla.suse.com/909474 SUSE Bug 909474 https://bugzilla.suse.com/909475 SUSE Bug 909475 https://bugzilla.suse.com/911837 SUSE Bug 911837 https://bugzilla.suse.com/968373 SUSE Bug 968373 https://bugzilla.suse.com/969776 SUSE Bug 969776 Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file. CVE-2014-8138 SUSE Linux Enterprise Desktop 11 SP3:libjasper-1.900.1-134.17.1 SUSE Linux Enterprise Desktop 11 SP3:libjasper-32bit-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libjasper-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libjasper-32bit-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:libjasper-x86-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3:libjasper-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3:libjasper-32bit-1.900.1-134.17.1 SUSE Linux Enterprise Server 11 SP3:libjasper-x86-1.900.1-134.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libjasper-1.900.1-134.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libjasper-32bit-1.900.1-134.17.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:libjasper-x86-1.900.1-134.17.1 SUSE Linux Enterprise Software Development Kit 11 SP3:libjasper-devel-1.900.1-134.17.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150258-1/ https://www.suse.com/security/cve/CVE-2014-8138.html CVE-2014-8138 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 https://bugzilla.suse.com/909474 SUSE Bug 909474 https://bugzilla.suse.com/909475 SUSE Bug 909475 https://bugzilla.suse.com/911837 SUSE Bug 911837 https://bugzilla.suse.com/969776 SUSE Bug 969776