Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS2-2023-2018

Related Vulnerabilities: CVE-2020-27828   CVE-2021-26926   CVE-2021-26927   CVE-2021-3272   CVE-2021-3443   CVE-2021-3467  

A flaw was found in the Jasper tool's jpc encoder. This flaw allows an attacker to craft input provided to Jasper, causing an arbitrary out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-27828) A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program crash. (CVE-2021-26926) A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service. (CVE-2021-26927) jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components. (CVE-2021-3272) A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened. (CVE-2021-3443) A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened. (CVE-2021-3467)

Source

ALAS2-2023-2018

Amazon Linux 2 Security Advisory: ALAS-2023-2018
Advisory Release Date: 2023-04-13 19:28 Pacific
Advisory Updated Date: 2023-04-20 18:23 Pacific
Severity: Important
Issue Overview:

A flaw was found in the Jasper tool's jpc encoder. This flaw allows an attacker to craft input provided to Jasper, causing an arbitrary out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. (CVE-2020-27828)

A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program crash. (CVE-2021-26926)

A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service. (CVE-2021-26927)

jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components. (CVE-2021-3272)

A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened. (CVE-2021-3443)

A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened. (CVE-2021-3467)


Affected Packages:

jasper


Issue Correction:
Run yum update jasper to update your system.

New Packages:
aarch64:
    jasper-1.900.1-33.amzn2.0.1.aarch64
    jasper-devel-1.900.1-33.amzn2.0.1.aarch64
    jasper-libs-1.900.1-33.amzn2.0.1.aarch64
    jasper-utils-1.900.1-33.amzn2.0.1.aarch64
    jasper-debuginfo-1.900.1-33.amzn2.0.1.aarch64

i686:
    jasper-1.900.1-33.amzn2.0.1.i686
    jasper-devel-1.900.1-33.amzn2.0.1.i686
    jasper-libs-1.900.1-33.amzn2.0.1.i686
    jasper-utils-1.900.1-33.amzn2.0.1.i686
    jasper-debuginfo-1.900.1-33.amzn2.0.1.i686

src:
    jasper-1.900.1-33.amzn2.0.1.src

x86_64:
    jasper-1.900.1-33.amzn2.0.1.x86_64
    jasper-devel-1.900.1-33.amzn2.0.1.x86_64
    jasper-libs-1.900.1-33.amzn2.0.1.x86_64
    jasper-utils-1.900.1-33.amzn2.0.1.x86_64
    jasper-debuginfo-1.900.1-33.amzn2.0.1.x86_64

Additional References

Red Hat: CVE-2020-27828, CVE-2021-26926, CVE-2021-26927, CVE-2021-3272, CVE-2021-3443, CVE-2021-3467

Mitre: CVE-2020-27828, CVE-2021-26926, CVE-2021-26927, CVE-2021-3272, CVE-2021-3443, CVE-2021-3467

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started