Security Fix(es) :

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2016-8654, CVE-2016-9560, CVE-2016-10249, CVE-2015-5203, CVE-2015-5221, CVE-2016-1577, CVE-2016-8690, CVE-2016-8693, CVE-2016-8884, CVE-2016-8885, CVE-2016-9262, CVE-2016-9591)

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. (CVE-2016-1867, CVE-2016-2089, CVE-2016-2116, CVE-2016-8691, CVE-2016-8692, CVE-2016-8883, CVE-2016-9387, CVE-2016-9388, CVE-2016-9389, CVE-2016-9390, CVE-2016-9391, CVE-2016-9392, CVE-2016-9393, CVE-2016-9394, CVE-2016-9583, CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)

Security fix for CVE-2016-8654

Security fix for CVE-2016-9262

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues :

Security issues fixed :

  - CVE-2016-9262: Multiple integer overflows in the     jas_realloc function in base/jas_malloc.c and mem_resize     function in base/jas_stream.c allow remote attackers to     cause a denial of service via a crafted image, which     triggers use after free vulnerabilities. (bsc#1009994)

  - CVE-2016-9388: The ras_getcmap function in ras_dec.c     allows remote attackers to cause a denial of service     (assertion failure) via a crafted image file.
    (bsc#1010975)

  - CVE-2016-9389: The jpc_irct and jpc_iict functions in     jpc_mct.c allow remote attackers to cause a denial of     service (assertion failure). (bsc#1010968)

  - CVE-2016-9390: The jas_seq2d_create function in     jas_seq.c allows remote attackers to cause a denial of     service (assertion failure) via a crafted image file.
    (bsc#1010774)

  - CVE-2016-9391: The jpc_bitstream_getbits function in     jpc_bs.c allows remote attackers to cause a denial of     service (assertion failure) via a very large integer.
    (bsc#1010782)

  - CVE-2017-1000050: The jp2_encode function in jp2_enc.c     allows remote attackers to cause a denial of service.
    (bsc#1047958)

CVEs already fixed with previous update :

  - CVE-2016-9392: The calcstepsizes function in jpc_dec.c     allows remote attackers to cause a denial of service     (assertion failure) via a crafted file. (bsc#1010757)

  - CVE-2016-9393: The jpc_pi_nextrpcl function in     jpc_t2cod.c allows remote attackers to cause a denial of     service (assertion failure) via a crafted file.
    (bsc#1010766)

  - CVE-2016-9394: The jas_seq2d_create function in     jas_seq.c allows remote attackers to cause a denial of     service (assertion failure) via a crafted file.
    (bsc#1010756)

This update was imported from the SUSE:SLE-12:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
100120	Scientific Linux Security Update : jasper on SL6.x, SL7.x i386/x86_64 (20170509)	Nessus	Scientific Linux Local Security Checks	2017/5/11	2025/12/19	high
97869	Fedora 24 : jasper (2017-c1bec8972c)	Nessus	Fedora Local Security Checks	2017/3/22	2025/12/29	high
101972	openSUSE Security Update : jasper (openSUSE-2017-844)	Nessus	SuSE Local Security Checks	2017/7/26	2025/12/9	high
97760	Fedora 25 : jasper (2017-3dba8a70ce)	Nessus	Fedora Local Security Checks	2017/3/16	2025/12/30	high

检测

插件搜索

high

high

high

high