CVE-2016-9560

Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.

The jasper package has been updated and patched to fix several security issues.

These are all security issues fixed in the jasper-1.900.14-3.1 package on the GA media of openSUSE Tumbleweed.

This update for jasper fixes the following issues:

• CVE-2016-8654: Heap-based buffer overflow in QMFB code in JPC codec. (bsc#1012530)
• CVE-2016-9395: Invalid jasper files could lead to abort of the library caused by attacker provided image. (bsc#1010977)
• CVE-2016-9398: Invalid jasper files could lead to abort of the library caused by attacker provided image. (bsc#1010979)
• CVE-2016-9560: Stack-based buffer overflow in jpc_tsfb_getbands2. (bsc#1011830)
• CVE-2016-9591: Use-after-free on heap in jas_matrix_destroy. (bsc#1015993)

This update for jasper fixes the following issues:

Security issues fixed:

• CVE-2016-8654: Heap-based buffer overflow in QMFB code in JPC codec (bsc#1012530)
• CVE-2016-9395: Missing sanity checks on the data in a SIZ marker segment (bsc#1010977).
• CVE-2016-9398: jpc_math.c:94: int jpc_floorlog2(int): Assertion 'x > 0' failed. (bsc#1010979)
• CVE-2016-9560: stack-based buffer overflow in jpc_tsfb_getbands2 (jpc_tsfb.c) (bsc#1011830)
• CVE-2016-9583: Out of bounds heap read in jpc_pi_nextpcrl() (bsc#1015400)
• CVE-2016-9591: Use-after-free on heap in jas_matrix_destroy (bsc#1015993)
• CVE-2016-9600: Null Pointer Dereference due to missing check for UNKNOWN color space in JP2 encoder (bsc#1018088)
• CVE-2016-10251: Use of uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c) (bsc#1029497)
• CVE-2017-5498: left-shift undefined behaviour (bsc#1020353)
• CVE-2017-6850: NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c) (bsc#1021868)

It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or automated system using JasPer were tricked into opening a specially crafted image, an attacker could exploit this to cause a denial of service or possibly execute code with the privileges of the user invoking the program.