Jasper - Security Update
Summary
DLA-739-1: jasper - security update. Affects jasper versions < 1.900.1-13+deb7u5. Fixed in 1.900.1-13+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jasper is an open-source software library for manipulating and viewing JPEG-2000 images. It provides a set of tools and APIs for encoding and decoding images in this format. The library is widely used in various applications and platforms. However, several vulnerabilities have been discovered in Jasper that could potentially be exploited by attackers to execute arbitrary code, cause denial of service, or trigger other security issues.
Vulnerability Detail
The vulnerabilities in Jasper include:
-
CVE-2016-8691: This vulnerability allows for a floating-point exception (FPE) on an unknown address during the processing of a JPEG-2000 image, leading to a potential crash or code execution.
-
CVE-2016-8692: Similar to the previous vulnerability, this one also triggers a floating-point exception on an unknown address during the processing of a JPEG-2000 image, potentially resulting in a crash or code execution.
-
CVE-2016-8693: This vulnerability involves a double-free attempt during the closing of a memory stream, which could lead to a crash or potential code execution.
-
CVE-2016-8882: A segmentation fault or null pointer access can occur in the jpc_pi_destroy function, potentially leading to a crash or code execution.
-
CVE-2016-9560: This vulnerability is a stack-based buffer overflow in the jpc_tsfb_getbands2 function, which could be exploited to execute arbitrary code.
-
CVE-2016-8887: This vulnerability involves a null pointer dereference in the jp2_colr_destroy function, which could result in a crash or code execution.
-
CVE-2016-8654: A heap-based buffer overflow can occur in the QMFB code of the JPC codec, potentially leading to arbitrary code execution.
-
CVE-2016-8883: An assertion failure can occur in the jpc_dec_tiledecode function, potentially leading to a crash or code execution.
These vulnerabilities pose significant risks to systems and applications that use the Jasper library, as they can be exploited by attackers to gain unauthorized access, execute arbitrary code, or cause denial of service.
How To Fix
Minimum fixed version
1.900.1-13+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade jasperTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. The recommended approach is to apply the available patches and upgrade to the fixed version of the Jasper package.
Conclusion
The vulnerabilities in Jasper pose significant risks to systems and applications using the library. It is crucial to apply the recommended patches and upgrade to the fixed version of the Jasper package to mitigate these risks. For further support and assistance with vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for jasper →
FAQ
Jasper is an open-source software library for manipulating and viewing JPEG-2000 images. It provides tools and APIs for encoding and decoding images in this format.
These vulnerabilities can be exploited by attackers to gain unauthorized access, execute arbitrary code, or cause denial of service on systems and applications using the Jasper library.
To fix these vulnerabilities, it is recommended to upgrade the Jasper package to version 1.900.1-13+deb7u5 or later. This version includes patches and fixes for the identified vulnerabilities.
There are no specific workarounds mentioned for these vulnerabilities. The recommended approach is to apply the available patches and upgrade to the fixed version of the Jasper package.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki.
Related vulnerabilities
Recent vulnerabilities recorded for jasper.
