Arch Linux

Summary
=======

The package jasper is vulnerable to multiple issues again including arbitrary code execution and denial of service via CVE-2017-6852, CVE-2017-6850, CVE-2017-5505, CVE-2017-5504 and CVE-2017-5503.

Guidance
========

Japer 1.900.1-debian1-2.4+deb8u3 used in debian look like is not affected by all but instead by some vulnerabilities.

affected in debian: CVE-2017-6852, CVE-2017-6850, CVE-2017-5505, CVE-2017-5504
fixed in debian: CVE-2017-5503

that last look like there is a fix forwarported on the github from the project.

References
==========

https://security.archlinux.org/AVG-206
https://blogs.gentoo.org/ago/2017/01/25/jasper-heap-based-buffer-overflow-in-jpc_dec_decodepkt-jpc_t2dec-c/
https://github.com/mdadams/jasper/issues/114
https://blogs.gentoo.org/ago/2017/01/25/jasper-null-pointer-dereference-in-jp2_cdef_destroy-jp2_cod-c/
https://github.com/mdadams/jasper/commit/e96fc4fdd525fa0ede28074a7e2b1caf94b58b0d
https://github.com/mdadams/jasper/issues/88
https://blogs.gentoo.org/ago/2017/01/16/jasper-invalid-memory-read-in-jas_matrix_asl-jas_seq-c/
https://github.com/mdadams/jasper/issues/89
https://blogs.gentoo.org/ago/2017/01/16/jasper-invalid-memory-read-in-jpc_undo_roi-jpc_dec-c/
https://github.com/mdadams/jasper/issues/90
https://blogs.gentoo.org/ago/2017/01/16/jasper-invalid-memory-write-in-dec_clnpass-jpc_t1dec-c