jasper-1.900.1-21.AXS4

This package contains an implementation of the image compression
standard JPEG-2000, Part 1. It consists of tools for conversion to and
from the JP2 and JPC formats.

Security issues fixed with this release:

CVE-2015-5203
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2015-5221
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2016-10248
The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before
1.900.9 allows remote attackers to cause a denial of service (NULL
pointer dereference) via vectors involving an empty sequence.
CVE-2016-10249
Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in
JasPer before 1.900.12 allows remote attackers to have unspecified
impact via a crafted image file, which triggers a heap-based buffer
overflow.
CVE-2016-10251
Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in
JasPer before 1.900.20 allows remote attackers to have unspecified
impact via a crafted file, which triggers use of an uninitialized
value.
CVE-2016-1577
Double free vulnerability in the jas_iccattrval_destroy function in
JasPer 1.900.1 and earlier allows remote attackers to cause a denial
of service (crash) or possibly execute arbitrary code via a crafted
ICC color profile in a JPEG 2000 image file, a different vulnerability
than CVE-2014-8137.
CVE-2016-1867
The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers
to cause a denial of service (out-of-bounds read and application
crash) via a crafted JPEG 2000 image.
CVE-2016-2089
The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows
remote attackers to cause a denial of service (invalid read and
application crash) via a crafted JPEG 2000 image.
CVE-2016-2116
Memory leak in the jas_iccprof_createfrombuf function in JasPer
1.900.1 and earlier allows remote attackers to cause a denial of
service (memory consumption) via a crafted ICC color profile in a JPEG
2000 image file.
CVE-2016-8654
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2016-8690
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before
1.900.5 allows remote attackers to cause a denial of service (NULL
pointer dereference) via a crafted BMP image in an imginfo command.
CVE-2016-8691
The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer
before 1.900.4 allows remote attackers to cause a denial of service
(divide-by-zero error and application crash) via a crafted XRsiz value
in a BMP image to the imginfo command.
CVE-2016-8692
The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer
before 1.900.4 allows remote attackers to cause a denial of service
(divide-by-zero error and application crash) via a crafted YRsiz value
in a BMP image to the imginfo command.
CVE-2016-8693
Double free vulnerability in the mem_close function in jas_stream.c in
JasPer before 1.900.10 allows remote attackers to cause a denial of
service (crash) or possibly execute arbitrary code via a crafted BMP
image to the imginfo command.
CVE-2016-8883
The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8
allows remote attackers to cause a denial of service (assertion
failure) via a crafted file.
CVE-2016-8884
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5
allows remote attackers to cause a denial of service (NULL pointer
dereference) by calling the imginfo command with a crafted BMP image.
NOTE: this vulnerability exists because of an incomplete fix for
CVE-2016-8690.
CVE-2016-8885
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before
1.900.9 allows remote attackers to cause a denial of service (NULL
pointer dereference) by calling the imginfo command with a crafted BMP
image.
CVE-2016-9262
Multiple integer overflows in the (1) jas_realloc function in
base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in
JasPer before 1.900.22 allow remote attackers to cause a denial of
service via a crafted image, which triggers use after free
vulnerabilities.
CVE-2016-9387
Integer overflow in the jpc_dec_process_siz function in
libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote
attackers to have unspecified impact via a crafted file, which
triggers an assertion failure.
CVE-2016-9388
The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows
remote attackers to cause a denial of service (assertion failure) via
a crafted image file.
CVE-2016-9389
The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before
1.900.14 allow remote attackers to cause a denial of service
(assertion failure).
CVE-2016-9390
The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14
allows remote attackers to cause a denial of service (assertion
failure) via a crafted image file.
CVE-2016-9391
The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10
allows remote attackers to cause a denial of service (assertion
failure) via a very large integer.
CVE-2016-9392
The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17
allows remote attackers to cause a denial of service (assertion
failure) via a crafted file.
CVE-2016-9393
The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17
allows remote attackers to cause a denial of service (assertion
failure) via a crafted file.
CVE-2016-9394
The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17
allows remote attackers to cause a denial of service (assertion
failure) via a crafted file.
CVE-2016-9560
Stack-based buffer overflow in the jpc_tsfb_getbands2 function in
jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have
unspecified impact via a crafted image.
CVE-2016-9583
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2016-9591
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.
CVE-2016-9600
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be
provided.