jasper-2.0.33-1.2 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10869 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z jasper-2.0.33-1.2 on GA media These are all security issues fixed in the jasper-2.0.33-1.2 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10869 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:10869 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2016-10251/ SUSE CVE CVE-2016-10251 page https://www.suse.com/security/cve/CVE-2016-9262/ SUSE CVE CVE-2016-9262 page https://www.suse.com/security/cve/CVE-2016-9387/ SUSE CVE CVE-2016-9387 page https://www.suse.com/security/cve/CVE-2016-9388/ SUSE CVE CVE-2016-9388 page https://www.suse.com/security/cve/CVE-2016-9389/ SUSE CVE CVE-2016-9389 page https://www.suse.com/security/cve/CVE-2016-9390/ SUSE CVE CVE-2016-9390 page https://www.suse.com/security/cve/CVE-2016-9391/ SUSE CVE CVE-2016-9391 page https://www.suse.com/security/cve/CVE-2016-9392/ SUSE CVE CVE-2016-9392 page https://www.suse.com/security/cve/CVE-2016-9393/ SUSE CVE CVE-2016-9393 page https://www.suse.com/security/cve/CVE-2016-9394/ SUSE CVE CVE-2016-9394 page https://www.suse.com/security/cve/CVE-2016-9396/ SUSE CVE CVE-2016-9396 page https://www.suse.com/security/cve/CVE-2016-9399/ SUSE CVE CVE-2016-9399 page https://www.suse.com/security/cve/CVE-2016-9557/ SUSE CVE CVE-2016-9557 page https://www.suse.com/security/cve/CVE-2016-9583/ SUSE CVE CVE-2016-9583 page https://www.suse.com/security/cve/CVE-2016-9591/ SUSE CVE CVE-2016-9591 page https://www.suse.com/security/cve/CVE-2016-9600/ SUSE CVE CVE-2016-9600 page https://www.suse.com/security/cve/CVE-2017-1000050/ SUSE CVE CVE-2017-1000050 page https://www.suse.com/security/cve/CVE-2017-13748/ SUSE CVE CVE-2017-13748 page https://www.suse.com/security/cve/CVE-2017-13750/ SUSE CVE CVE-2017-13750 page https://www.suse.com/security/cve/CVE-2017-14132/ SUSE CVE CVE-2017-14132 page https://www.suse.com/security/cve/CVE-2017-5498/ SUSE CVE CVE-2017-5498 page https://www.suse.com/security/cve/CVE-2017-5499/ SUSE CVE CVE-2017-5499 page https://www.suse.com/security/cve/CVE-2017-5503/ SUSE CVE CVE-2017-5503 page https://www.suse.com/security/cve/CVE-2017-6850/ SUSE CVE CVE-2017-6850 page https://www.suse.com/security/cve/CVE-2018-18873/ SUSE CVE CVE-2018-18873 page https://www.suse.com/security/cve/CVE-2018-19139/ SUSE CVE CVE-2018-19139 page https://www.suse.com/security/cve/CVE-2018-19539/ SUSE CVE CVE-2018-19539 page https://www.suse.com/security/cve/CVE-2018-19540/ SUSE CVE CVE-2018-19540 page https://www.suse.com/security/cve/CVE-2018-19541/ SUSE CVE CVE-2018-19541 page https://www.suse.com/security/cve/CVE-2018-19542/ SUSE CVE CVE-2018-19542 page https://www.suse.com/security/cve/CVE-2018-19543/ SUSE CVE CVE-2018-19543 page https://www.suse.com/security/cve/CVE-2018-20570/ SUSE CVE CVE-2018-20570 page https://www.suse.com/security/cve/CVE-2018-20622/ SUSE CVE CVE-2018-20622 page https://www.suse.com/security/cve/CVE-2018-9055/ SUSE CVE CVE-2018-9055 page https://www.suse.com/security/cve/CVE-2018-9154/ SUSE CVE CVE-2018-9154 page https://www.suse.com/security/cve/CVE-2018-9252/ SUSE CVE CVE-2018-9252 page https://www.suse.com/security/cve/CVE-2020-27828/ SUSE CVE CVE-2020-27828 page https://www.suse.com/security/cve/CVE-2021-3272/ SUSE CVE CVE-2021-3272 page openSUSE Tumbleweed jasper-2.0.33-1.2 libjasper-devel-2.0.33-1.2 libjasper4-2.0.33-1.2 libjasper4-32bit-2.0.33-1.2 jasper-2.0.33-1.2 as a component of openSUSE Tumbleweed libjasper-devel-2.0.33-1.2 as a component of openSUSE Tumbleweed libjasper4-2.0.33-1.2 as a component of openSUSE Tumbleweed libjasper4-32bit-2.0.33-1.2 as a component of openSUSE Tumbleweed Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value. CVE-2016-10251 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-10251.html CVE-2016-10251 https://bugzilla.suse.com/1029497 SUSE Bug 1029497 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities. CVE-2016-9262 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9262.html CVE-2016-9262 https://bugzilla.suse.com/1009994 SUSE Bug 1009994 https://bugzilla.suse.com/1078851 SUSE Bug 1078851 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure. CVE-2016-9387 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9387.html CVE-2016-9387 https://bugzilla.suse.com/1010960 SUSE Bug 1010960 The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. CVE-2016-9388 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9388.html CVE-2016-9388 https://bugzilla.suse.com/1010975 SUSE Bug 1010975 https://bugzilla.suse.com/1078851 SUSE Bug 1078851 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure). CVE-2016-9389 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9389.html CVE-2016-9389 https://bugzilla.suse.com/1010968 SUSE Bug 1010968 https://bugzilla.suse.com/1078851 SUSE Bug 1078851 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. CVE-2016-9390 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9390.html CVE-2016-9390 https://bugzilla.suse.com/1010774 SUSE Bug 1010774 https://bugzilla.suse.com/1078851 SUSE Bug 1078851 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer. CVE-2016-9391 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9391.html CVE-2016-9391 https://bugzilla.suse.com/1010782 SUSE Bug 1010782 https://bugzilla.suse.com/1078851 SUSE Bug 1078851 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. CVE-2016-9392 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9392.html CVE-2016-9392 https://bugzilla.suse.com/1010757 SUSE Bug 1010757 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. CVE-2016-9393 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9393.html CVE-2016-9393 https://bugzilla.suse.com/1010757 SUSE Bug 1010757 https://bugzilla.suse.com/1010766 SUSE Bug 1010766 https://bugzilla.suse.com/1078851 SUSE Bug 1078851 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. CVE-2016-9394 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9394.html CVE-2016-9394 https://bugzilla.suse.com/1010756 SUSE Bug 1010756 https://bugzilla.suse.com/1010757 SUSE Bug 1010757 https://bugzilla.suse.com/1078851 SUSE Bug 1078851 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors. CVE-2016-9396 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9396.html CVE-2016-9396 https://bugzilla.suse.com/1010783 SUSE Bug 1010783 https://bugzilla.suse.com/1021871 SUSE Bug 1021871 https://bugzilla.suse.com/1082397 SUSE Bug 1082397 https://bugzilla.suse.com/1154883 SUSE Bug 1154883 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors. CVE-2016-9399 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 1.5 AV:L/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9399.html CVE-2016-9399 https://bugzilla.suse.com/1010980 SUSE Bug 1010980 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 Integer overflow in jas_image.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (application crash) via a crafted file. CVE-2016-9557 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9557.html CVE-2016-9557 https://bugzilla.suse.com/1010786 SUSE Bug 1010786 https://bugzilla.suse.com/1011829 SUSE Bug 1011829 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input. CVE-2016-9583 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9583.html CVE-2016-9583 https://bugzilla.suse.com/1015400 SUSE Bug 1015400 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer. CVE-2016-9591 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9591.html CVE-2016-9591 https://bugzilla.suse.com/1015993 SUSE Bug 1015993 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. CVE-2016-9600 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9600.html CVE-2016-9600 https://bugzilla.suse.com/1018088 SUSE Bug 1018088 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service. CVE-2017-1000050 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-1000050.html CVE-2017-1000050 https://bugzilla.suse.com/1047958 SUSE Bug 1047958 https://bugzilla.suse.com/1078851 SUSE Bug 1078851 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote denial of service attack. CVE-2017-13748 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-13748.html CVE-2017-13748 https://bugzilla.suse.com/1053919 SUSE Bug 1053919 https://bugzilla.suse.com/1056066 SUSE Bug 1056066 There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer 2.0.12 that will lead to a remote denial of service attack. CVE-2017-13750 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-13750.html CVE-2017-13750 https://bugzilla.suse.com/1053919 SUSE Bug 1053919 https://bugzilla.suse.com/1056064 SUSE Bug 1056064 JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, related to the jas_image_ishomosamp function in libjasper/base/jas_image.c. CVE-2017-14132 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-14132.html CVE-2017-14132 https://bugzilla.suse.com/1057152 SUSE Bug 1057152 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 libjasper/include/jasper/jas_math.h in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value. CVE-2017-5498 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-5498.html CVE-2017-5498 https://bugzilla.suse.com/1020353 SUSE Bug 1020353 https://bugzilla.suse.com/1020451 SUSE Bug 1020451 https://bugzilla.suse.com/1020456 SUSE Bug 1020456 https://bugzilla.suse.com/1020460 SUSE Bug 1020460 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 Integer overflow in libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file. CVE-2017-5499 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-5499.html CVE-2017-5499 https://bugzilla.suse.com/1020451 SUSE Bug 1020451 https://bugzilla.suse.com/1020456 SUSE Bug 1020456 https://bugzilla.suse.com/1020460 SUSE Bug 1020460 https://bugzilla.suse.com/1115637 SUSE Bug 1115637 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 The dec_clnpass function in libjasper/jpc/jpc_t1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via a crafted image. CVE-2017-5503 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-5503.html CVE-2017-5503 https://bugzilla.suse.com/1020456 SUSE Bug 1020456 https://bugzilla.suse.com/1020458 SUSE Bug 1020458 https://bugzilla.suse.com/1020460 SUSE Bug 1020460 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted image. CVE-2017-6850 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-6850.html CVE-2017-6850 https://bugzilla.suse.com/1021868 SUSE Bug 1021868 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c. CVE-2018-18873 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-18873.html CVE-2018-18873 https://bugzilla.suse.com/1114495 SUSE Bug 1114495 https://bugzilla.suse.com/1114498 SUSE Bug 1114498 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 An issue has been found in JasPer 2.0.14. There is a memory leak in jas_malloc.c when called from jpc_unk_getparms in jpc_cs.c. CVE-2018-19139 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-19139.html CVE-2018-19139 https://bugzilla.suse.com/1115637 SUSE Bug 1115637 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, leading to a denial of service. CVE-2018-19539 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-19539.html CVE-2018-19539 https://bugzilla.suse.com/1117511 SUSE Bug 1117511 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer overflow of size 1 in the function jas_icctxtdesc_input in libjasper/base/jas_icc.c. CVE-2018-19540 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-19540.html CVE-2018-19540 https://bugzilla.suse.com/1117508 SUSE Bug 1117508 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c. CVE-2018-19541 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-19541.html CVE-2018-19541 https://bugzilla.suse.com/1117507 SUSE Bug 1117507 https://bugzilla.suse.com/1119411 SUSE Bug 1119411 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading to a denial of service. CVE-2018-19542 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-19542.html CVE-2018-19542 https://bugzilla.suse.com/1117505 SUSE Bug 1117505 https://bugzilla.suse.com/1117507 SUSE Bug 1117507 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c. CVE-2018-19543 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-19543.html CVE-2018-19543 https://bugzilla.suse.com/1045450 SUSE Bug 1045450 https://bugzilla.suse.com/1117328 SUSE Bug 1117328 https://bugzilla.suse.com/1117507 SUSE Bug 1117507 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 jp2_encode in jp2/jp2_enc.c in JasPer 2.0.14 has a heap-based buffer over-read. CVE-2018-20570 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-20570.html CVE-2018-20570 https://bugzilla.suse.com/1120807 SUSE Bug 1120807 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 JasPer 2.0.14 has a memory leak in base/jas_malloc.c in libjasper.a when "--output-format jp2" is used. CVE-2018-20622 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-20622.html CVE-2018-20622 https://bugzilla.suse.com/1115637 SUSE Bug 1115637 https://bugzilla.suse.com/1120805 SUSE Bug 1120805 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c. CVE-2018-9055 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-9055.html CVE-2018-9055 https://bugzilla.suse.com/1087020 SUSE Bug 1087020 https://bugzilla.suse.com/1088278 SUSE Bug 1088278 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack by triggering an unexpected jas_alloc2 return value, a different vulnerability than CVE-2017-13745. CVE-2018-9154 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-9154.html CVE-2018-9154 https://bugzilla.suse.com/1092115 SUSE Bug 1092115 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c. CVE-2018-9252 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-9252.html CVE-2018-9252 https://bugzilla.suse.com/1088278 SUSE Bug 1088278 https://bugzilla.suse.com/1178702 SUSE Bug 1178702 There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality, integrity, or application availability. CVE-2020-27828 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-27828.html CVE-2020-27828 https://bugzilla.suse.com/1179748 SUSE Bug 1179748 jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components. CVE-2021-3272 openSUSE Tumbleweed:jasper-2.0.33-1.2 openSUSE Tumbleweed:libjasper-devel-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-2.0.33-1.2 openSUSE Tumbleweed:libjasper4-32bit-2.0.33-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3272.html CVE-2021-3272 https://bugzilla.suse.com/1181483 SUSE Bug 1181483