| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070821045755.GB22619@outflux.net>
Date: Mon, 20 Aug 2007 21:57:55 -0700
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-501-1] jasper vulnerability
===========================================================
Ubuntu Security Notice USN-501-1 August 20, 2007
jasper vulnerability
CVE-2007-2721
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 6.10
Ubuntu 7.04
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
libjasper-1.701-1 1.701.0-2ubuntu0.6.06
Ubuntu 6.10:
libjasper-1.701-1 1.701.0-2ubuntu0.6.10
Ubuntu 7.04:
libjasper-1.701-1 1.701.0-2ubuntu0.7.04
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
It was discovered that Jasper did not correctly handle corrupted JPEG2000
images. By tricking a user into opening a specially crafted JPG, a
remote attacker could cause the application using libjasper to crash,
resulting in a denial of service.
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.06.diff.gz
Size/MD5: 27685 36bc20ad8fed6be2be9234d0e885ddb4
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.06.dsc
Size/MD5: 703 4ef3f8aa9c25abe46543182565a04723
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0.orig.tar.gz
Size/MD5: 1084413 ceed8e5e4fc58ac8faca0bd4be8a7b7d
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06_amd64.deb
Size/MD5: 146304 6e19b2f1d5413ac11b8b2f44e8b2d3a1
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06_amd64.deb
Size/MD5: 635466 5e34f97417a85a7528b3fd71132513a3
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06_amd64.deb
Size/MD5: 23990 b79229de5c543921e198ac317a8aa8b7
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06_i386.deb
Size/MD5: 132948 f2628a87c8ede60598ed6aab24056083
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06_i386.deb
Size/MD5: 618752 9dc1d2b887a07d89fe65c1f13c7d56af
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06_i386.deb
Size/MD5: 21550 11c123f5348e0321a5bd5ab82a40e510
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06_powerpc.deb
Size/MD5: 142186 dba639f5f1bedd2894460da451bc8ea0
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06_powerpc.deb
Size/MD5: 623492 35c7b4d2655a8b7e268d096d2eb4cd3a
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06_powerpc.deb
Size/MD5: 27608 dbcd32346e878e108e3bbd8b7164ae4f
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06_sparc.deb
Size/MD5: 132854 43aba17b4393a430b10834959c21033f
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06_sparc.deb
Size/MD5: 622804 aaafe4bf9881ba872cb7d8a8545b1609
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06_sparc.deb
Size/MD5: 22150 b9053b5ca947b7d9ca2bd181f40cc927
Updated packages for Ubuntu 6.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.10.diff.gz
Size/MD5: 27896 7b1df387b06afc872cf492da10b6e14f
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.10.dsc
Size/MD5: 703 81284ec0e268b4e469c1d0710623202c
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0.orig.tar.gz
Size/MD5: 1084413 ceed8e5e4fc58ac8faca0bd4be8a7b7d
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.10_amd64.deb
Size/MD5: 144174 5cae483f23fe33fc9274c8097a4aa7a5
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.10_amd64.deb
Size/MD5: 632984 17040c1fe443256184caabb2fa8e0ea3
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.10_amd64.deb
Size/MD5: 23984 10112f9f595bf45cc765fcdc94db1bd0
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.10_i386.deb
Size/MD5: 137166 47d5dc7da36b62eae81bba8cd938dd21
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.10_i386.deb
Size/MD5: 622752 6b00883416207ebf5ac594c648d518a6
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.10_i386.deb
Size/MD5: 21942 1b9bff4f446707ab650a96b17f2ee530
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.10_powerpc.deb
Size/MD5: 142476 5c9af3239ff67f3e3a41b500e51a5c97
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.10_powerpc.deb
Size/MD5: 623368 823aa572c7908cd783d5afd2abe72cb8
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.10_powerpc.deb
Size/MD5: 27884 c19d47c444fcb33ae71fe8d4029af95a
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.10_sparc.deb
Size/MD5: 133288 cc8b0bf20221f1eda2aa88de88a86530
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.10_sparc.deb
Size/MD5: 623114 2b9e44390e958df619963a8ff6f6af7b
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.10_sparc.deb
Size/MD5: 22270 dcaab635659035d2eb641086033153e1
Updated packages for Ubuntu 7.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.7.04.diff.gz
Size/MD5: 28036 e7afddd87ca3d81e79a3d12c0da6a9ea
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.7.04.dsc
Size/MD5: 787 363d773596b808d5dae163df71eef172
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0.orig.tar.gz
Size/MD5: 1084413 ceed8e5e4fc58ac8faca0bd4be8a7b7d
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.7.04_amd64.deb
Size/MD5: 146276 94bca2efb4c48c42d433e1b65b004a0e
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.7.04_amd64.deb
Size/MD5: 633106 64276280a4fecb457fba855adc815743
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.7.04_amd64.deb
Size/MD5: 24156 56998ee09ef2d9db432157bd908f87a0
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.7.04_i386.deb
Size/MD5: 139334 b824eb9c1026468eeeb672cec47ec846
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.7.04_i386.deb
Size/MD5: 622772 36a55b4f0f95652b3053b3883a7324aa
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.7.04_i386.deb
Size/MD5: 22006 a78115e6c1aa1e8e7fbdc81c808f7483
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.7.04_powerpc.deb
Size/MD5: 151038 66fbc8317b65b605745de34c5013b010
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.7.04_powerpc.deb
Size/MD5: 628020 012d1ba2e46a5397e74f56871d220984
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.7.04_powerpc.deb
Size/MD5: 30648 901b963fe8e03aba67b11c4acd38ce35
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.7.04_sparc.deb
Size/MD5: 135160 c1b6f6b89b82c378b04f5ee113e3eef2
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.7.04_sparc.deb
Size/MD5: 622950 61abf7fc9c0713c3b11baf40625846c9
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.7.04_sparc.deb
Size/MD5: 23260 fe5f2bc921747c970d2c5a20b81d5aca
Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists