-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-6c789ba91d 2016-11-10 13:46:09.606970 --------------------------------------------------------------------------------
Name : jasper Product : Fedora 23 Version : 1.900.13 Release : 1.fc23 URL : http://www.ece.uvic.ca/~frodo/jasper/ Summary : Implementation of the JPEG-2000 standard, Part 1 Description : This package contains an implementation of the image compression standard JPEG-2000, Part 1. It consists of tools for conversion to and from the JP2 and JPC formats.
-------------------------------------------------------------------------------- Update Information:
This update contains security fix for CVE-2016-8883, CVE-2016-8882, CVE-2016-8881, CVE-2016-8880, CVE-2016-8884, CVE-2016-8885, CVE-2016-8887, CVE-2016-8886. ---- New version of jasper is available (jasper-1.900.13). Security fix for CVE-2016-8690, CVE-2016-8691, CVE-2016-8692, CVE-2016-8693. ---- New version of jasper is available (1.900.3) ---- Security fix for CVE-2016-2089 ---- New version of jasper is available. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1385507 - CVE-2016-8693 jasper: Double free vulnerability in mem_close https://bugzilla.redhat.com/show_bug.cgi?id=1385507 [ 2 ] Bug #1385503 - CVE-2016-8692 jasper: Divide by zero in jpc_dec_process_siz https://bugzilla.redhat.com/show_bug.cgi?id=1385503 [ 3 ] Bug #1385502 - CVE-2016-8691 jasper: Divide by zero in jpc_dec_process_siz https://bugzilla.redhat.com/show_bug.cgi?id=1385502 [ 4 ] Bug #1385499 - CVE-2016-8690 jasper: Null pointer dereference in bmp_getdata triggered by crafted BMP image https://bugzilla.redhat.com/show_bug.cgi?id=1385499 [ 5 ] Bug #1302636 - CVE-2016-2089 jasper: matrix rows_ NULL pointer dereference in jas_matrix_clip() https://bugzilla.redhat.com/show_bug.cgi?id=1302636 [ 6 ] Bug #1388880 - CVE-2016-8886 jasper: memory allocation failure in jas_malloc https://bugzilla.redhat.com/show_bug.cgi?id=1388880 [ 7 ] Bug #1388828 - CVE-2016-8887 jasper: Null pointer dereference in jp2_colr_destroy https://bugzilla.redhat.com/show_bug.cgi?id=1388828 [ 8 ] Bug #1388829 - jasper: Null pointer dereference in jp2_colr_destroy (incomplete fix for CVE-2016-8887) https://bugzilla.redhat.com/show_bug.cgi?id=1388829 [ 9 ] Bug #1388831 - CVE-2016-8884 CVE-2016-8885 jasper: Null pointer dereference in bmp_getdata (incomplete fix for CVE-2016-8690) https://bugzilla.redhat.com/show_bug.cgi?id=1388831 [ 10 ] Bug #1388840 - jasper: Heap-based buffer overflow in jpc_dec_tiledecode https://bugzilla.redhat.com/show_bug.cgi?id=1388840 [ 11 ] Bug #1388863 - CVE-2016-8880 jasper: Heap buffer overflow in jpc_dec_cp_setfromcox() https://bugzilla.redhat.com/show_bug.cgi?id=1388863 [ 12 ] Bug #1388864 - CVE-2016-8881 jasper: Heap buffer overflow in jpc_getuint16() https://bugzilla.redhat.com/show_bug.cgi?id=1388864 [ 13 ] Bug #1388866 - CVE-2016-8882 jasper: Null pointer access in jpc_pi_destroy https://bugzilla.redhat.com/show_bug.cgi?id=1388866 [ 14 ] Bug #1388870 - CVE-2016-8883 jasper: Assert in jpc_dec_tiledecode() https://bugzilla.redhat.com/show_bug.cgi?id=1388870 --------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade jasper' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
package-announce@lists.fedoraproject.org
-
updates＠fedoraproject.org