| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1237485766.6324.5.camel@mdlinux.technorage.com>
Date: Thu, 19 Mar 2009 14:02:46 -0400
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-742-1] JasPer vulnerabilities
===========================================================
Ubuntu Security Notice USN-742-1 March 19, 2009
jasper vulnerabilities
CVE-2008-3520, CVE-2008-3521, CVE-2008-3522
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 7.10
Ubuntu 8.04 LTS
Ubuntu 8.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
libjasper-1.701-1 1.701.0-2ubuntu0.6.06.1
Ubuntu 7.10:
libjasper1 1.900.1-3ubuntu0.7.10.1
Ubuntu 8.04 LTS:
libjasper1 1.900.1-3ubuntu0.8.04.1
Ubuntu 8.10:
libjasper1 1.900.1-5ubuntu0.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
It was discovered that JasPer did not correctly handle memory allocation
when parsing certain malformed JPEG2000 images. If a user were tricked into
opening a specially crafted image with an application that uses libjasper,
an attacker could cause a denial of service and possibly execute arbitrary
code with the user's privileges. (CVE-2008-3520)
It was discovered that JasPer created temporary files in an insecure way.
Local users could exploit a race condition and cause a denial of service in
libjasper applications.
(CVE-2008-3521)
It was discovered that JasPer did not correctly handle certain formatting
operations. If a user were tricked into opening a specially crafted image
with an application that uses libjasper, an attacker could cause a denial
of service and possibly execute arbitrary code with the user's privileges.
(CVE-2008-3522)
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.06.1.diff.gz
Size/MD5: 34544 cce3c647820e55fae518eb081a77545a
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.06.1.dsc
Size/MD5: 715 3f7c5d2155ab4f259aab9bcc8aa64c0a
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0.orig.tar.gz
Size/MD5: 1084413 ceed8e5e4fc58ac8faca0bd4be8a7b7d
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_amd64.deb
Size/MD5: 146814 020471e3651a9c2fafd6eefedadb3f75
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_amd64.deb
Size/MD5: 636044 a614b7cd20832821f75ae66bcf639675
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_amd64.deb
Size/MD5: 24296 a799121b0c020afa47dda1454c777aa8
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_i386.deb
Size/MD5: 133552 7b3aebd21e1506b8cde1d0ab2602b685
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_i386.deb
Size/MD5: 619430 c5739e01e9d69506da8e6d956d05af96
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_i386.deb
Size/MD5: 21890 6f01dc80f5a3dbd14325935e755301ee
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_powerpc.deb
Size/MD5: 142700 e1253e0a77c84326db1dac4317ca196d
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_powerpc.deb
Size/MD5: 624160 fec9bc6cacf18fb5fbe42183e9dbdf08
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_powerpc.deb
Size/MD5: 27932 31413f853f0a0ce38ed6355200f377f5
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_sparc.deb
Size/MD5: 133302 a9f4ba112f2bf58554120454072b57a8
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_sparc.deb
Size/MD5: 623384 a5863b651eaedfdff5c9deaacb26dbb9
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_sparc.deb
Size/MD5: 22492 f711a38841e73fd99ef8146d8aca8eae
Updated packages for Ubuntu 7.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.7.10.1.diff.gz
Size/MD5: 49782 f6b41bf096b45f95964bde8822419e22
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.7.10.1.dsc
Size/MD5: 787 84f1be39211afbf546f4865aa2c93b93
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1.orig.tar.gz
Size/MD5: 1143400 4ae3dd938fd15f22f30577db5c9f27e9
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_amd64.deb
Size/MD5: 560066 121337bb5de35638aee77f2e6f5b4175
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_amd64.deb
Size/MD5: 151764 304a3001b55dda77b03b87b58dcce17e
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_amd64.deb
Size/MD5: 25552 6cf1e402a960a58ee076513f7224bd93
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_i386.deb
Size/MD5: 548268 51fd5964f1593d5c5652d82f94be2f65
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_i386.deb
Size/MD5: 144134 4051b7784cf9167f394bc0543758aadc
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_i386.deb
Size/MD5: 23126 f1c103e3b437b004c62044e77a6fd789
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_lpia.deb
Size/MD5: 548046 03c662544f78e41aa52b4eb0cef88f5e
http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_lpia.deb
Size/MD5: 145604 f163501caa0ec88be92150e27177be07
http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_lpia.deb
Size/MD5: 23288 b231d9da0cd70d816dc8aa0324d02f81
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_powerpc.deb
Size/MD5: 554840 6ed5498df3429753a6b8149ff35d9713
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_powerpc.deb
Size/MD5: 156696 6d6301d54dcfcb54351c8b7a29cd0e98
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_powerpc.deb
Size/MD5: 31970 64002762586577cd40494a75daf072c6
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_sparc.deb
Size/MD5: 546862 bad1d4f79ac9a0abfe4b722ca94299a9
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_sparc.deb
Size/MD5: 138864 059db193b061fe0152be74ff6f7afe0d
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_sparc.deb
Size/MD5: 24654 3f7c1c3623b76ef1bf87a4e269ce0959
Updated packages for Ubuntu 8.04 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.8.04.1.diff.gz
Size/MD5: 49784 140289a8237818c78c094142470562be
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.8.04.1.dsc
Size/MD5: 787 d110d94a13ba861e16d5a53d2fa06a0d
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1.orig.tar.gz
Size/MD5: 1143400 4ae3dd938fd15f22f30577db5c9f27e9
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_amd64.deb
Size/MD5: 560628 5ad790436c98d5b9cf0a6d4b31676999
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_amd64.deb
Size/MD5: 149284 3e91312e9bfec2f8f15cbb6c7137276c
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_amd64.deb
Size/MD5: 25430 b587ab277fd41171e0f1f1576e2d9ca8
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_i386.deb
Size/MD5: 548014 81bfeab149dd028ab86b682910248264
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_i386.deb
Size/MD5: 140772 099c812e2107df16ec5f448fd4dd24ee
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_i386.deb
Size/MD5: 23250 5c4bb207c9eab2d64e7d2012f2adebe7
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_lpia.deb
Size/MD5: 547934 4f03a5626dde55be41d3403b07aacb27
http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_lpia.deb
Size/MD5: 142492 a07e3596c6b2d436402a1658582b3e06
http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_lpia.deb
Size/MD5: 23258 e280973f4522be895b4e3c06fcdf7a6f
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_powerpc.deb
Size/MD5: 554736 e51d72ed422e517dd93602585732713a
http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_powerpc.deb
Size/MD5: 151722 c11f4cdae73aac0cb3b265ba59fbfff0
http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_powerpc.deb
Size/MD5: 32328 d168c11f56f84810e7ed072c615497a3
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_sparc.deb
Size/MD5: 545368 e32366827751c4747af02d1706f23192
http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_sparc.deb
Size/MD5: 136120 f6b6f67d4d6ce88fb1edc6f4528bb678
http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_sparc.deb
Size/MD5: 24538 f8aba59b6f69e220cf6e68a3bfb71d37
Updated packages for Ubuntu 8.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-5ubuntu0.1.diff.gz
Size/MD5: 52688 1b4d2d4ee9a459a451913b675b263d62
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-5ubuntu0.1.dsc
Size/MD5: 1187 fb314df8a6f5247edb747987f8d76f02
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1.orig.tar.gz
Size/MD5: 1143400 4ae3dd938fd15f22f30577db5c9f27e9
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_amd64.deb
Size/MD5: 562142 c2f25e04c912a1b64c4dfce1eb7dd3d5
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_amd64.deb
Size/MD5: 151868 6e8b66b557cc7a794c6c14fb6d588d81
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_amd64.deb
Size/MD5: 25758 ca74bf783944c89242555b641b2e5f90
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_i386.deb
Size/MD5: 550168 812497f62590b915fd0329e810295675
http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_i386.deb
Size/MD5: 143290 d9c1b2e6abca55d5fc8bd2a0408887d9
http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_i386.deb
Size/MD5: 23616 af8d3d8dcdf8ec7e92b470bd3e0edfc5
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_lpia.deb
Size/MD5: 549832 8be0a5f2995b25b20cdb0bd8608a9b2d
http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_lpia.deb
Size/MD5: 144942 6655936af1cd1a43455b25b5fca92c7e
http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_lpia.deb
Size/MD5: 23516 dc7791cea2c443a07c9eba67944873b8
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_powerpc.deb
Size/MD5: 557240 da2293d915a7fe54cb28af6d1c492dda
http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_powerpc.deb
Size/MD5: 154072 885f88a8d11e3b2375fd7633b0d18f60
http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_powerpc.deb
Size/MD5: 31458 f17ad2b7f030b844ef1bc01db1b07cd5
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_sparc.deb
Size/MD5: 545474 cb6fdbec36215740768dde9466434151
http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_sparc.deb
Size/MD5: 136986 1940aab6c284ec22bd70b4a5ee6b432a
http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_sparc.deb
Size/MD5: 24666 2716a795c39dea1835cd9f69f9e061c3
Download attachment "signature.asc" of type "application/pgp-signature" (198 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists