Security update for jasper SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1479-1 Final 1 1 2022-04-29T15:32:30Z current 2022-04-29T15:32:30Z 2022-04-29T15:32:30Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for jasper This update for jasper fixes the following issues: - CVE-2021-3467: Fixed NULL pointer deref in jp2_decode() (bsc#1184757). - CVE-2021-3443: Fixed NULL pointer deref in jp2_decode() (bsc#1184798). - CVE-2021-26927: Fixed NULL pointer deref in jp2_decode() (bsc#1182104). - CVE-2021-26926: Fixed an out of bounds read in jp2_decode() (bsc#1182105). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-1479,SUSE-SLE-Module-Basesystem-15-SP3-2022-1479,SUSE-SLE-Module-Basesystem-15-SP4-2022-1479,SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-1479,SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-1479,SUSE-SLE-Product-RT-15-SP2-2022-1479,openSUSE-SLE-15.3-2022-1479,openSUSE-SLE-15.4-2022-1479 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221479-1/ Link for SUSE-SU-2022:1479-1 https://lists.suse.com/pipermail/sle-security-updates/2022-April/010902.html E-Mail link for SUSE-SU-2022:1479-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1182104 SUSE Bug 1182104 https://bugzilla.suse.com/1182105 SUSE Bug 1182105 https://bugzilla.suse.com/1184757 SUSE Bug 1184757 https://bugzilla.suse.com/1184798 SUSE Bug 1184798 https://www.suse.com/security/cve/CVE-2021-26926/ SUSE CVE CVE-2021-26926 page https://www.suse.com/security/cve/CVE-2021-26927/ SUSE CVE CVE-2021-26927 page https://www.suse.com/security/cve/CVE-2021-3443/ SUSE CVE CVE-2021-3443 page https://www.suse.com/security/cve/CVE-2021-3467/ SUSE CVE CVE-2021-3467 page SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Real Time 15 SP2 openSUSE Leap 15.3 openSUSE Leap 15.4 jasper-2.0.14-150000.3.25.1 libjasper-devel-2.0.14-150000.3.25.1 libjasper4-2.0.14-150000.3.25.1 libjasper4-32bit-2.0.14-150000.3.25.1 libjasper4-64bit-2.0.14-150000.3.25.1 libjasper4-2.0.14-150000.3.25.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 libjasper-devel-2.0.14-150000.3.25.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 libjasper-devel-2.0.14-150000.3.25.1 as a component of SUSE Linux Enterprise Real Time 15 SP2 libjasper4-2.0.14-150000.3.25.1 as a component of SUSE Linux Enterprise Real Time 15 SP2 jasper-2.0.14-150000.3.25.1 as a component of openSUSE Leap 15.3 libjasper-devel-2.0.14-150000.3.25.1 as a component of openSUSE Leap 15.3 libjasper4-2.0.14-150000.3.25.1 as a component of openSUSE Leap 15.3 libjasper4-32bit-2.0.14-150000.3.25.1 as a component of openSUSE Leap 15.3 jasper-2.0.14-150000.3.25.1 as a component of openSUSE Leap 15.4 libjasper-devel-2.0.14-150000.3.25.1 as a component of openSUSE Leap 15.4 libjasper4-2.0.14-150000.3.25.1 as a component of openSUSE Leap 15.4 libjasper4-32bit-2.0.14-150000.3.25.1 as a component of openSUSE Leap 15.4 A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program crash. CVE-2021-26926 SUSE Linux Enterprise Module for Basesystem 15 SP3:libjasper4-2.0.14-150000.3.25.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:libjasper-devel-2.0.14-150000.3.25.1 SUSE Linux Enterprise Real Time 15 SP2:libjasper-devel-2.0.14-150000.3.25.1 SUSE Linux Enterprise Real Time 15 SP2:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.3:jasper-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper-devel-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper4-32bit-2.0.14-150000.3.25.1 openSUSE Leap 15.4:jasper-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper-devel-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper4-32bit-2.0.14-150000.3.25.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221479-1/ https://www.suse.com/security/cve/CVE-2021-26926.html CVE-2021-26926 https://bugzilla.suse.com/1182105 SUSE Bug 1182105 A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service. CVE-2021-26927 SUSE Linux Enterprise Module for Basesystem 15 SP3:libjasper4-2.0.14-150000.3.25.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:libjasper-devel-2.0.14-150000.3.25.1 SUSE Linux Enterprise Real Time 15 SP2:libjasper-devel-2.0.14-150000.3.25.1 SUSE Linux Enterprise Real Time 15 SP2:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.3:jasper-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper-devel-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper4-32bit-2.0.14-150000.3.25.1 openSUSE Leap 15.4:jasper-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper-devel-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper4-32bit-2.0.14-150000.3.25.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221479-1/ https://www.suse.com/security/cve/CVE-2021-26927.html CVE-2021-26927 https://bugzilla.suse.com/1182104 SUSE Bug 1182104 A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened. CVE-2021-3443 SUSE Linux Enterprise Module for Basesystem 15 SP3:libjasper4-2.0.14-150000.3.25.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:libjasper-devel-2.0.14-150000.3.25.1 SUSE Linux Enterprise Real Time 15 SP2:libjasper-devel-2.0.14-150000.3.25.1 SUSE Linux Enterprise Real Time 15 SP2:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.3:jasper-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper-devel-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper4-32bit-2.0.14-150000.3.25.1 openSUSE Leap 15.4:jasper-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper-devel-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper4-32bit-2.0.14-150000.3.25.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221479-1/ https://www.suse.com/security/cve/CVE-2021-3443.html CVE-2021-3443 https://bugzilla.suse.com/1184798 SUSE Bug 1184798 A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened. CVE-2021-3467 SUSE Linux Enterprise Module for Basesystem 15 SP3:libjasper4-2.0.14-150000.3.25.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:libjasper-devel-2.0.14-150000.3.25.1 SUSE Linux Enterprise Real Time 15 SP2:libjasper-devel-2.0.14-150000.3.25.1 SUSE Linux Enterprise Real Time 15 SP2:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.3:jasper-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper-devel-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.3:libjasper4-32bit-2.0.14-150000.3.25.1 openSUSE Leap 15.4:jasper-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper-devel-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper4-2.0.14-150000.3.25.1 openSUSE Leap 15.4:libjasper4-32bit-2.0.14-150000.3.25.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221479-1/ https://www.suse.com/security/cve/CVE-2021-3467.html CVE-2021-3467 https://bugzilla.suse.com/1184757 SUSE Bug 1184757