A vulnerability was found in jasper. A crafted file could cause a signed integer overflow. References: http://seclists.org/oss-sec/2017/q1/101
Upstream bug report: https://github.com/mdadams/jasper/issues/63 This issue has not been resolved upstream yet (the current upstream version is 2.0.12). Reporter's advisory: https://blogs.gentoo.org/ago/2017/01/16/jasper-multiple-crashes-with-ubsan/ Relevant information from the advisory: With the undefined behavior sanitizer enabled, jasper crashes showing some left shift and some signed integer overflow. ... Affected version / Tested on: 1.900.17 Fixed version: N/A Commit fix: N/A Relevant part of the stacktrace: # imginfo -f $FILE /tmp/portage/media-libs/jasper-1.900.17/work/jasper-1.900.17/src/libjasper/jpc/jpc_dec.c:1838:9: runtime error: signed integer overflow: -64356352 * 6359082673847140352 cannot be represented in type 'long' CVE: CVE-2017-5499
The important information form the advisory is that this crash only occurs when jasper is compiles with undefined behaviour sanitizer (ubsan) enabled. That is a development tool aimed to identify possible code bugs related to undefined behaviour. There is no crash as described by this CVE in builds not using ubsan.
Upstream commit: https://github.com/jasper-software/jasper/commit/8c4e99592e7da53a9de2934bc7781535d0e0595d Fixed upstream in jasper 2.0.17.