[gdal-dev] [Fwd: [USN-742-1] JasPer vulnerabilities]

Mateusz Loskot mateusz at loskot.net
Thu Mar 19 18:17:52 EDT 2009 

Hi,

Perhaps this is something interesting for GDAL users
-- Mateusz

-------- Original Message --------
Subject: [USN-742-1] JasPer vulnerabilities
Date: Thu, 19 Mar 2009 14:02:46 -0400
From: Marc Deslauriers <marc.deslauriers at canonical.com>
Reply-To: ubuntu-users at lists.ubuntu.com, Ubuntu Security
<security at ubuntu.com>
To: ubuntu-security-announce at lists.ubuntu.com
CC: full-disclosure at lists.grok.org.uk, bugtraq at securityfocus.com
	
===========================================================
Ubuntu Security Notice USN-742-1             March 19, 2009
jasper vulnerabilities
CVE-2008-3520, CVE-2008-3521, CVE-2008-3522
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 7.10
Ubuntu 8.04 LTS
Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  libjasper-1.701-1               1.701.0-2ubuntu0.6.06.1

Ubuntu 7.10:
  libjasper1                      1.900.1-3ubuntu0.7.10.1

Ubuntu 8.04 LTS:
  libjasper1                      1.900.1-3ubuntu0.8.04.1

Ubuntu 8.10:
  libjasper1                      1.900.1-5ubuntu0.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that JasPer did not correctly handle memory allocation
when parsing certain malformed JPEG2000 images. If a user were tricked
into opening a specially crafted image with an application that uses
libjasper, an attacker could cause a denial of service and possibly
execute arbitrary code with the user's privileges. (CVE-2008-3520)

It was discovered that JasPer created temporary files in an insecure
way. Local users could exploit a race condition and cause a denial of
service in libjasper applications. (CVE-2008-3521)

It was discovered that JasPer did not correctly handle certain
formatting operations. If a user were tricked into opening a specially
crafted image with an application that uses libjasper, an attacker could
cause a denial of service and possibly execute arbitrary code with the
user's privileges. (CVE-2008-3522)


Updated packages for Ubuntu 6.06 LTS:

  Source archives:


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.06.1.diff.gz
      Size/MD5:    34544 cce3c647820e55fae518eb081a77545a

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.06.1.dsc
      Size/MD5:      715 3f7c5d2155ab4f259aab9bcc8aa64c0a

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0.orig.tar.gz
      Size/MD5:  1084413 ceed8e5e4fc58ac8faca0bd4be8a7b7d

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_amd64.deb
      Size/MD5:   146814 020471e3651a9c2fafd6eefedadb3f75

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_amd64.deb
      Size/MD5:   636044 a614b7cd20832821f75ae66bcf639675

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_amd64.deb
      Size/MD5:    24296 a799121b0c020afa47dda1454c777aa8

  i386 architecture (x86 compatible Intel/AMD):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_i386.deb
      Size/MD5:   133552 7b3aebd21e1506b8cde1d0ab2602b685

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_i386.deb
      Size/MD5:   619430 c5739e01e9d69506da8e6d956d05af96

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_i386.deb
      Size/MD5:    21890 6f01dc80f5a3dbd14325935e755301ee

  powerpc architecture (Apple Macintosh G3/G4/G5):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_powerpc.deb
      Size/MD5:   142700 e1253e0a77c84326db1dac4317ca196d

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_powerpc.deb
      Size/MD5:   624160 fec9bc6cacf18fb5fbe42183e9dbdf08

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_powerpc.deb
      Size/MD5:    27932 31413f853f0a0ce38ed6355200f377f5

  sparc architecture (Sun SPARC/UltraSPARC):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_sparc.deb
      Size/MD5:   133302 a9f4ba112f2bf58554120454072b57a8

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_sparc.deb
      Size/MD5:   623384 a5863b651eaedfdff5c9deaacb26dbb9

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_sparc.deb
      Size/MD5:    22492 f711a38841e73fd99ef8146d8aca8eae

Updated packages for Ubuntu 7.10:

  Source archives:


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.7.10.1.diff.gz
      Size/MD5:    49782 f6b41bf096b45f95964bde8822419e22

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.7.10.1.dsc
      Size/MD5:      787 84f1be39211afbf546f4865aa2c93b93

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1.orig.tar.gz
      Size/MD5:  1143400 4ae3dd938fd15f22f30577db5c9f27e9

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_amd64.deb
      Size/MD5:   560066 121337bb5de35638aee77f2e6f5b4175

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_amd64.deb
      Size/MD5:   151764 304a3001b55dda77b03b87b58dcce17e

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_amd64.deb
      Size/MD5:    25552 6cf1e402a960a58ee076513f7224bd93

  i386 architecture (x86 compatible Intel/AMD):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_i386.deb
      Size/MD5:   548268 51fd5964f1593d5c5652d82f94be2f65

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_i386.deb
      Size/MD5:   144134 4051b7784cf9167f394bc0543758aadc

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_i386.deb
      Size/MD5:    23126 f1c103e3b437b004c62044e77a6fd789

  lpia architecture (Low Power Intel Architecture):


http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_lpia.deb
      Size/MD5:   548046 03c662544f78e41aa52b4eb0cef88f5e

http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_lpia.deb
      Size/MD5:   145604 f163501caa0ec88be92150e27177be07

http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_lpia.deb
      Size/MD5:    23288 b231d9da0cd70d816dc8aa0324d02f81

  powerpc architecture (Apple Macintosh G3/G4/G5):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_powerpc.deb
      Size/MD5:   554840 6ed5498df3429753a6b8149ff35d9713

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_powerpc.deb
      Size/MD5:   156696 6d6301d54dcfcb54351c8b7a29cd0e98

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_powerpc.deb
      Size/MD5:    31970 64002762586577cd40494a75daf072c6

  sparc architecture (Sun SPARC/UltraSPARC):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_sparc.deb
      Size/MD5:   546862 bad1d4f79ac9a0abfe4b722ca94299a9

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_sparc.deb
      Size/MD5:   138864 059db193b061fe0152be74ff6f7afe0d

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_sparc.deb
      Size/MD5:    24654 3f7c1c3623b76ef1bf87a4e269ce0959

Updated packages for Ubuntu 8.04 LTS:

  Source archives:


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.8.04.1.diff.gz
      Size/MD5:    49784 140289a8237818c78c094142470562be

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.8.04.1.dsc
      Size/MD5:      787 d110d94a13ba861e16d5a53d2fa06a0d

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1.orig.tar.gz
      Size/MD5:  1143400 4ae3dd938fd15f22f30577db5c9f27e9

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_amd64.deb
      Size/MD5:   560628 5ad790436c98d5b9cf0a6d4b31676999

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_amd64.deb
      Size/MD5:   149284 3e91312e9bfec2f8f15cbb6c7137276c

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_amd64.deb
      Size/MD5:    25430 b587ab277fd41171e0f1f1576e2d9ca8

  i386 architecture (x86 compatible Intel/AMD):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_i386.deb
      Size/MD5:   548014 81bfeab149dd028ab86b682910248264

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_i386.deb
      Size/MD5:   140772 099c812e2107df16ec5f448fd4dd24ee

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_i386.deb
      Size/MD5:    23250 5c4bb207c9eab2d64e7d2012f2adebe7

  lpia architecture (Low Power Intel Architecture):


http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_lpia.deb
      Size/MD5:   547934 4f03a5626dde55be41d3403b07aacb27

http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_lpia.deb
      Size/MD5:   142492 a07e3596c6b2d436402a1658582b3e06

http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_lpia.deb
      Size/MD5:    23258 e280973f4522be895b4e3c06fcdf7a6f

  powerpc architecture (Apple Macintosh G3/G4/G5):


http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_powerpc.deb
      Size/MD5:   554736 e51d72ed422e517dd93602585732713a

http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_powerpc.deb
      Size/MD5:   151722 c11f4cdae73aac0cb3b265ba59fbfff0

http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_powerpc.deb
      Size/MD5:    32328 d168c11f56f84810e7ed072c615497a3

  sparc architecture (Sun SPARC/UltraSPARC):


http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_sparc.deb
      Size/MD5:   545368 e32366827751c4747af02d1706f23192

http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_sparc.deb
      Size/MD5:   136120 f6b6f67d4d6ce88fb1edc6f4528bb678

http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_sparc.deb
      Size/MD5:    24538 f8aba59b6f69e220cf6e68a3bfb71d37

Updated packages for Ubuntu 8.10:

  Source archives:


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-5ubuntu0.1.diff.gz
      Size/MD5:    52688 1b4d2d4ee9a459a451913b675b263d62

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-5ubuntu0.1.dsc
      Size/MD5:     1187 fb314df8a6f5247edb747987f8d76f02

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1.orig.tar.gz
      Size/MD5:  1143400 4ae3dd938fd15f22f30577db5c9f27e9

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_amd64.deb
      Size/MD5:   562142 c2f25e04c912a1b64c4dfce1eb7dd3d5

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_amd64.deb
      Size/MD5:   151868 6e8b66b557cc7a794c6c14fb6d588d81

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_amd64.deb
      Size/MD5:    25758 ca74bf783944c89242555b641b2e5f90

  i386 architecture (x86 compatible Intel/AMD):


http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_i386.deb
      Size/MD5:   550168 812497f62590b915fd0329e810295675

http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_i386.deb
      Size/MD5:   143290 d9c1b2e6abca55d5fc8bd2a0408887d9

http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_i386.deb
      Size/MD5:    23616 af8d3d8dcdf8ec7e92b470bd3e0edfc5

  lpia architecture (Low Power Intel Architecture):


http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_lpia.deb
      Size/MD5:   549832 8be0a5f2995b25b20cdb0bd8608a9b2d

http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_lpia.deb
      Size/MD5:   144942 6655936af1cd1a43455b25b5fca92c7e

http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_lpia.deb
      Size/MD5:    23516 dc7791cea2c443a07c9eba67944873b8

  powerpc architecture (Apple Macintosh G3/G4/G5):


http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_powerpc.deb
      Size/MD5:   557240 da2293d915a7fe54cb28af6d1c492dda

http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_powerpc.deb
      Size/MD5:   154072 885f88a8d11e3b2375fd7633b0d18f60

http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_powerpc.deb
      Size/MD5:    31458 f17ad2b7f030b844ef1bc01db1b07cd5

  sparc architecture (Sun SPARC/UltraSPARC):


http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_sparc.deb
      Size/MD5:   545474 cb6fdbec36215740768dde9466434151

http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_sparc.deb
      Size/MD5:   136986 1940aab6c284ec22bd70b4a5ee6b432a

http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_sparc.deb
      Size/MD5:    24666 2716a795c39dea1835cd9f69f9e061c3


-- 
Mateusz Loskot, http://mateusz.loskot.net
Charter Member of OSGeo, http://osgeo.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
Url : http://lists.osgeo.org/pipermail/gdal-dev/attachments/20090319/4e56283b/signature-0001.bin

More information about the gdal-dev mailing list