Advisories ยป MGASA-2021-0113

Updated jasper packages fix security vulnerability

Publication date: 04 Mar 2021
Modification date: 04 Mar 2021
Type: security
Affected Mageia releases : 7
CVE: CVE-2021-3272 , CVE-2021-26926 , CVE-2021-26927

Description

jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based
buffer over-read when there is an invalid relationship between the number of
channels and the number of image components (CVE-2021-3272).

A flaw was found in jasper. An out of bounds read issue was found in jp2_decode
function which may lead to disclosure of information or program crash
(CVE-2021-26926).

A flaw was found in jasper. A null pointer dereference in jp2_decode in
jp2_dec.c may lead to program crash and denial of service (CVE-2021-26927).

References

SRPMS

7/core