bugtraq - [USN-501-1] jasper vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20070821045755.GB22619@outflux.net>
Date: Mon, 20 Aug 2007 21:57:55 -0700
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [USN-501-1] jasper vulnerability

=========================================================== 
Ubuntu Security Notice USN-501-1            August 20, 2007
jasper vulnerability
CVE-2007-2721
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 6.10
Ubuntu 7.04

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  libjasper-1.701-1                        1.701.0-2ubuntu0.6.06

Ubuntu 6.10:
  libjasper-1.701-1                        1.701.0-2ubuntu0.6.10

Ubuntu 7.04:
  libjasper-1.701-1                        1.701.0-2ubuntu0.7.04

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that Jasper did not correctly handle corrupted JPEG2000
images.  By tricking a user into opening a specially crafted JPG, a
remote attacker could cause the application using libjasper to crash,
resulting in a denial of service.


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.06.diff.gz
      Size/MD5:    27685 36bc20ad8fed6be2be9234d0e885ddb4
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.06.dsc
      Size/MD5:      703 4ef3f8aa9c25abe46543182565a04723
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0.orig.tar.gz
      Size/MD5:  1084413 ceed8e5e4fc58ac8faca0bd4be8a7b7d

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06_amd64.deb
      Size/MD5:   146304 6e19b2f1d5413ac11b8b2f44e8b2d3a1
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06_amd64.deb
      Size/MD5:   635466 5e34f97417a85a7528b3fd71132513a3
    http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06_amd64.deb
      Size/MD5:    23990 b79229de5c543921e198ac317a8aa8b7

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06_i386.deb
      Size/MD5:   132948 f2628a87c8ede60598ed6aab24056083
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06_i386.deb
      Size/MD5:   618752 9dc1d2b887a07d89fe65c1f13c7d56af
    http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06_i386.deb
      Size/MD5:    21550 11c123f5348e0321a5bd5ab82a40e510

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06_powerpc.deb
      Size/MD5:   142186 dba639f5f1bedd2894460da451bc8ea0
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06_powerpc.deb
      Size/MD5:   623492 35c7b4d2655a8b7e268d096d2eb4cd3a
    http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06_powerpc.deb
      Size/MD5:    27608 dbcd32346e878e108e3bbd8b7164ae4f

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06_sparc.deb
      Size/MD5:   132854 43aba17b4393a430b10834959c21033f
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06_sparc.deb
      Size/MD5:   622804 aaafe4bf9881ba872cb7d8a8545b1609
    http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06_sparc.deb
      Size/MD5:    22150 b9053b5ca947b7d9ca2bd181f40cc927

Updated packages for Ubuntu 6.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.10.diff.gz
      Size/MD5:    27896 7b1df387b06afc872cf492da10b6e14f
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.10.dsc
      Size/MD5:      703 81284ec0e268b4e469c1d0710623202c
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0.orig.tar.gz
      Size/MD5:  1084413 ceed8e5e4fc58ac8faca0bd4be8a7b7d

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.10_amd64.deb
      Size/MD5:   144174 5cae483f23fe33fc9274c8097a4aa7a5
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.10_amd64.deb
      Size/MD5:   632984 17040c1fe443256184caabb2fa8e0ea3
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.10_amd64.deb
      Size/MD5:    23984 10112f9f595bf45cc765fcdc94db1bd0

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.10_i386.deb
      Size/MD5:   137166 47d5dc7da36b62eae81bba8cd938dd21
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.10_i386.deb
      Size/MD5:   622752 6b00883416207ebf5ac594c648d518a6
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.10_i386.deb
      Size/MD5:    21942 1b9bff4f446707ab650a96b17f2ee530

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.10_powerpc.deb
      Size/MD5:   142476 5c9af3239ff67f3e3a41b500e51a5c97
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.10_powerpc.deb
      Size/MD5:   623368 823aa572c7908cd783d5afd2abe72cb8
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.10_powerpc.deb
      Size/MD5:    27884 c19d47c444fcb33ae71fe8d4029af95a

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.10_sparc.deb
      Size/MD5:   133288 cc8b0bf20221f1eda2aa88de88a86530
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.10_sparc.deb
      Size/MD5:   623114 2b9e44390e958df619963a8ff6f6af7b
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.10_sparc.deb
      Size/MD5:    22270 dcaab635659035d2eb641086033153e1

Updated packages for Ubuntu 7.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.7.04.diff.gz
      Size/MD5:    28036 e7afddd87ca3d81e79a3d12c0da6a9ea
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.7.04.dsc
      Size/MD5:      787 363d773596b808d5dae163df71eef172
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0.orig.tar.gz
      Size/MD5:  1084413 ceed8e5e4fc58ac8faca0bd4be8a7b7d

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.7.04_amd64.deb
      Size/MD5:   146276 94bca2efb4c48c42d433e1b65b004a0e
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.7.04_amd64.deb
      Size/MD5:   633106 64276280a4fecb457fba855adc815743
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.7.04_amd64.deb
      Size/MD5:    24156 56998ee09ef2d9db432157bd908f87a0

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.7.04_i386.deb
      Size/MD5:   139334 b824eb9c1026468eeeb672cec47ec846
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.7.04_i386.deb
      Size/MD5:   622772 36a55b4f0f95652b3053b3883a7324aa
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.7.04_i386.deb
      Size/MD5:    22006 a78115e6c1aa1e8e7fbdc81c808f7483

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.7.04_powerpc.deb
      Size/MD5:   151038 66fbc8317b65b605745de34c5013b010
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.7.04_powerpc.deb
      Size/MD5:   628020 012d1ba2e46a5397e74f56871d220984
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.7.04_powerpc.deb
      Size/MD5:    30648 901b963fe8e03aba67b11c4acd38ce35

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.7.04_sparc.deb
      Size/MD5:   135160 c1b6f6b89b82c378b04f5ee113e3eef2
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.7.04_sparc.deb
      Size/MD5:   622950 61abf7fc9c0713c3b11baf40625846c9
    http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.7.04_sparc.deb
      Size/MD5:    23260 fe5f2bc921747c970d2c5a20b81d5aca


Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)