SB2018040423 - Multiple vulnerabilities in JasPer

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2018-9154)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

There is a reachable abort in the function jpc_dec_process_sot in libjasper/jpc/jpc_dec.c of JasPer 2.0.14 that will lead to a remote denial of service attack by triggering an unexpected jas_alloc2 return value, a different vulnerability than CVE-2017-13745.

2) Reachable Assertion (CVE-ID: CVE-2018-9252)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c.

Remediation

Install update from vendor's website.

References

• https://drive.google.com/drive/u/2/folders/1YuxdfbZrw79kfzoQz0PpxIutZ7pkf_kW
• https://security.gentoo.org/glsa/201908-03
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://github.com/mdadams/jasper/issues/173