Advisories » MGASA-2016-0059

Updated jasper packages fix CVE-2016-1867

Publication date: 09 Feb 2016
Modification date: 09 Feb 2016
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-1867

Description

Updated jasper packages fix security vulnerabilities:

The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to
cause a denial of service (out-of-bounds read and application crash) via a
crafted JPEG 2000 image (CVE-2016-1867).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=16629
• http://openwall.com/lists/oss-security/2016/01/13/6
• http://lists.opensuse.org/opensuse-updates/2016-01/msg00077.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1867

SRPMS

5/core

• jasper-1.900.1-20.3.mga5