JasPer is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service. References: http://www.openwall.com/lists/oss-security/2017/03/06/1
Created jasper tracking bugs for this issue: Affects: fedora-all [bug 1434464] Created mingw-jasper tracking bugs for this issue: Affects: epel-7 [bug 1434465] Affects: fedora-all [bug 1434467]
Upstream bug report: https://github.com/mdadams/jasper/issues/120 Upstream commit: https://github.com/mdadams/jasper/commit/58ba0365d911b9f9dd68e9abf826682c0b4f2293 The fix is included in version 2.0.13. This bug is in encoder, therefore applications that only use jasper to read JPEG2000 images are not affected, it only affects applications that read untrusted images and convert them to JPEG2000 format using jasper.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:3253 https://access.redhat.com/errata/RHSA-2018:3253