Security update for jasper SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1420-1 Final 1 1 2020-05-26T10:24:02Z current 2020-05-26T10:24:02Z 2020-05-26T10:24:02Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for jasper This update for jasper fixes the following issues: - CVE-2018-9154: Fixed a potential denial of service in jpc_dec_process_sot() (bsc#1092115). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1420,SUSE-SLE-Module-Basesystem-15-SP1-2020-1420,SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-1420 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201420-1/ Link for SUSE-SU-2020:1420-1 https://lists.suse.com/pipermail/sle-security-updates/2020-May/006858.html E-Mail link for SUSE-SU-2020:1420-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1092115 SUSE Bug 1092115 https://www.suse.com/security/cve/CVE-2018-9154/ SUSE CVE CVE-2018-9154 page SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 jasper-2.0.14-3.11.8 libjasper-devel-2.0.14-3.11.8 libjasper4-2.0.14-3.11.8 libjasper4-32bit-2.0.14-3.11.8 libjasper4-64bit-2.0.14-3.11.8 libjasper4-2.0.14-3.11.8 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 libjasper-devel-2.0.14-3.11.8 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack by triggering an unexpected jas_alloc2 return value, a different vulnerability than CVE-2017-13745. CVE-2018-9154 SUSE Linux Enterprise Module for Basesystem 15 SP1:libjasper4-2.0.14-3.11.8 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libjasper-devel-2.0.14-3.11.8 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201420-1/ https://www.suse.com/security/cve/CVE-2018-9154.html CVE-2018-9154 https://bugzilla.suse.com/1092115 SUSE Bug 1092115 https://bugzilla.suse.com/1178702 SUSE Bug 1178702