Mageia alert MGASA-2016-0059 (jasper)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2016-0059: Updated jasper packages fix CVE-2016-1867 
Date:
    	     
 
Tue, 9 Feb 2016 20:05:57 +0100
Message-ID:
    	     
 
<20160209190557.D83319F6FB@duvel.mageia.org>
MGASA-2016-0059 - Updated jasper packages fix CVE-2016-1867

Publication date: 09 Feb 2016
URL: http://advisories.mageia.org/MGASA-2016-0059.html
Type: security
Affected Mageia releases: 5
CVE: CVE-2016-1867

Description:
Updated jasper packages fix security vulnerabilities:

The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to
cause a denial of service (out-of-bounds read and application crash) via a
crafted JPEG 2000 image (CVE-2016-1867).

References:
- https://bugs.mageia.org/show_bug.cgi?id=16629
- http://openwall.com/lists/oss-security/2016/01/13/6
- http://lists.opensuse.org/opensuse-updates/2016-01/msg000...
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1867

SRPMS:
- 5/core/jasper-1.900.1-20.3.mga5