Skip to content
OpenAdvisories
Low ALAS2-2019-1150 2 CVEs

Low: jasper security update (Amazon Linux 2)

Published Jan 23, 2019 · Updated Jan 25, 2019

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-1000050: JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service. 1472888: CVE-2017-1000050 jasper: NULL pointer exception in jp2_encode() CVE-2016-9396: The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors. 1396978: CVE-2016-9396 jasper: reachable assertion in JPC_NOMINALGAIN()

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 jasper 0:1.900.1-33.amzn2
Amazon Linux · 2 jasper-debuginfo 0:1.900.1-33.amzn2
Amazon Linux · 2 jasper-devel 0:1.900.1-33.amzn2
Amazon Linux · 2 jasper-libs 0:1.900.1-33.amzn2
Amazon Linux · 2 jasper-utils 0:1.900.1-33.amzn2

Vulnerabilities 2

  • Unscored —

    The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of s…

  • Unscored —

    JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the …

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2016-9396.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2017-1000050.html