SB2008121601 - Gentoo update for JasPer

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2008-3520)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.

2) Buffer overflow (CVE-ID: CVE-2008-3522)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/
• https://security.gentoo.org/glsa/200812-18