First Last Prev Next    This bug is not in your last search results.
Bug 941919 - (CVE-2015-5203) VUL-0: CVE-2015-5203: jasper: Double free corruption in JasPer JPEG-2000 implementation
(CVE-2015-5203)
VUL-0: CVE-2015-5203: jasper: Double free corruption in JasPer JPEG-2000 impl...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Fridrich Strba
Security Team bot
https://smash.suse.de/issue/124592/
CVSSv2:SUSE:CVE-2015-5203:1.9:(AV:L/A...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2015-08-17 09:19 UTC by Alexander Bergmann
Modified: 2019-11-02 19:48 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2015-08-17 09:19:26 UTC 
CVE-2015-5203

From: Gustavo Grieco <gustavo.grieco () gmail com>
Date: Sun, 16 Aug 2015 17:22:50 +0200

A new double free affecting JasPer JPEG-2000 (libjasper 1.900) has been
found triggered by function jasper_image_stop_load.
Despite this library is used by many programs (
http://www.ece.uvic.ca/~frodo/jasper/#overview), there is no one providing
support, so there is no fix so far.

This vulnerability was found by QuickFuzz.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5203
http://seclists.org/oss-sec/2015/q3/366
Comment 1 Swamp Workflow Management 2015-08-17 22:00:16 UTC 
bugbot adjusting priority
Comment 3 Sebastian Krahmer 2015-08-25 08:01:29 UTC 
This seems to be a fix proposal (via oss-sec):

http://sf.net/projects/mancha/files/sec/jasper-1.900.1_CVE-2015-5203.diff
Comment 4 Fridrich Strba 2015-08-25 08:14:49 UTC 
(In reply to Sebastian Krahmer from comment #3)
> This seems to be a fix proposal (via oss-sec):
> http://sf.net/projects/mancha/files/sec/jasper-1.900.1_CVE-2015-5203.diff

The jas_stream.h is a public header. This fix though breaks ABI especially on 64-bit systems. This is not a big deal, provided that the soname will be bumped too.
Comment 5 Victor Pereira 2015-09-03 08:04:52 UTC 
more information about it https://bugzilla.redhat.com/show_bug.cgi?id=1254242#c3
Comment 7 Swamp Workflow Management 2016-11-04 12:08:36 UTC 
openSUSE-SU-2016:2722-1: An update that fixes 14 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,392410,941919,942553,968373
CVE References: CVE-2008-3522,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8886
Sources used:
openSUSE 13.2 (src):    jasper-1.900.14-163.24.1
Comment 8 Swamp Workflow Management 2016-11-05 14:09:27 UTC 
openSUSE-SU-2016:2737-1: An update that fixes 26 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,1006836,1006839,1007009,941919
CVE References: CVE-2008-3522,CVE-2011-4516,CVE-2011-4517,CVE-2014-8137,CVE-2014-8138,CVE-2014-8157,CVE-2014-8158,CVE-2014-9029,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-1867,CVE-2016-2089,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8884,CVE-2016-8885,CVE-2016-8886,CVE-2016-8887
Sources used:
openSUSE 13.1 (src):    jasper-1.900.14-160.25.1
Comment 9 Swamp Workflow Management 2016-11-10 20:09:37 UTC 
SUSE-SU-2016:2775-1: An update that fixes 20 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,1006836,1006839,1007009,392410,941919,942553,961886,963983,968373
CVE References: CVE-2008-3522,CVE-2014-8158,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-1867,CVE-2016-2089,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8884,CVE-2016-8885,CVE-2016-8886,CVE-2016-8887
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Server 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Server 12-SP1 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    jasper-1.900.14-181.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    jasper-1.900.14-181.1
Comment 10 Swamp Workflow Management 2016-11-10 20:12:16 UTC 
SUSE-SU-2016:2776-1: An update that fixes 19 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,1006836,1006839,1007009,392410,941919,942553,961886,963983,968373
CVE References: CVE-2008-3522,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-1867,CVE-2016-2089,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8884,CVE-2016-8885,CVE-2016-8886,CVE-2016-8887
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    jasper-1.900.14-134.25.1
SUSE Linux Enterprise Server 11-SP4 (src):    jasper-1.900.14-134.25.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    jasper-1.900.14-134.25.1
Comment 11 Swamp Workflow Management 2016-11-17 19:09:47 UTC 
openSUSE-SU-2016:2833-1: An update that fixes 20 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1005084,1005090,1005242,1006591,1006593,1006597,1006598,1006599,1006836,1006839,1007009,392410,941919,942553,961886,963983,968373
CVE References: CVE-2008-3522,CVE-2014-8158,CVE-2015-5203,CVE-2015-5221,CVE-2016-1577,CVE-2016-1867,CVE-2016-2089,CVE-2016-2116,CVE-2016-8690,CVE-2016-8691,CVE-2016-8692,CVE-2016-8693,CVE-2016-8880,CVE-2016-8881,CVE-2016-8882,CVE-2016-8883,CVE-2016-8884,CVE-2016-8885,CVE-2016-8886,CVE-2016-8887
Sources used:
openSUSE Leap 42.2 (src):    jasper-1.900.14-167.1
openSUSE Leap 42.1 (src):    jasper-1.900.14-166.1
Comment 13 Swamp Workflow Management 2017-07-25 13:25:07 UTC 
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2017-08-08.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/63789
Comment 14 Marcus Meissner 2019-11-02 19:48:25 UTC 
released
First Last Prev Next    This bug is not in your last search results.