An assertion failure was possible to trigger in jpc_dequantize. CVE assignment: http://seclists.org/oss-sec/2016/q4/441
Created mingw-jasper tracking bugs for this issue: Affects: fedora-all [bug 1396987] Affects: epel-7 [bug 1396989]
Created jasper tracking bugs for this issue: Affects: fedora-all [bug 1396986] Affects: epel-5 [bug 1396988]
Original reporter's advisory: https://blogs.gentoo.org/ago/2016/11/16/jasper-multiple-assertion-failure/ Relevant part of the advisory: Affected version: 1.900.13 Output/failure: type = 0xff76 (UNKNOWN); len = 20;00 40 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 imginfo: /tmp/portage/media-libs/jasper-1.900.13/work/jasper-1.900.13/src/libjasper/jpc/jpc_dec.c:1817: void jpc_dequantize(jas_matrix_t *, jpc_fix_t): Assertion `absstepsize >= 0′ failed. Commit fix: N/A Fixed version: N/A Testcase: https://github.com/asarubbo/poc/blob/master/00010-jasper-assert-jpc_dequantize CVE: CVE-2016-9397 Upstream bug report: https://github.com/mdadams/jasper/issues/56
The reproducer does not work against recent jasper versions. However, that only seems to be a side effect of a different fix causing jasper to abort image parsing earlier, rather than actually being fixed.
Remains unfixed in 2.0.11.