Debian has issued an advisory today (December 4): https://www.debian.org/security/2014/dsa-3089 Patched packages uploaded for Mageia 4 and Cauldron. Advisory: ======================== Updated jasper packages fix security vulnerability: Josh Duart of the Google Security Team discovered heap-based buffer overflow flaws in JasPer, which could lead to denial of service (application crash) or the execution of arbitrary code (CVE-2014-9029). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9029 https://www.debian.org/security/2014/dsa-3089 ======================== Updated packages in core/updates_testing: ======================== jasper-1.900.1-15.1.mga4 libjasper1-1.900.1-15.1.mga4 libjasper-devel-1.900.1-15.1.mga4 libjasper-static-devel-1.900.1-15.1.mga4 from jasper-1.900.1-15.1.mga4.src.rpm Reproducible: Steps to Reproduce:
In VirtualBox, M4, KDE, 32-bit imagemagick & imagemagick-desktop uses jasper Package(s) under test: jasper imagemagick use imagemagick with the ImageMagick-desktop icon default install of jasper & imagemagick [root@localhost wilcal]# urpmi jasper Package jasper-1.900.1-15.mga4.i586 is already installed [root@localhost wilcal]# urpmi imagemagick Package imagemagick-6.8.7.0-2.3.mga4.i586 is already installed I can open, and edit, a jpg image with the ImageMagick-desktop icon install package from updates_testing [root@localhost wilcal]# urpmi jasper Package jasper-1.900.1-15.1.mga4.i586 is already installed [root@localhost wilcal]# urpmi imagemagick Package imagemagick-6.8.7.0-2.3.mga4.i586 is already installed ( there are no updates to the imagemagick packages ) I can open, and edit, a jpg image with the ImageMagick-desktop icon Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver virtualbox-4.3.10-1.1.mga4.x86_64 virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64
CC: (none) => wilcal.intWhiteboard: (none) => MGA4-32-OK
In VirtualBox, M4, KDE, 64-bit imagemagick & imagemagick-desktop uses jasper Package(s) under test: jasper lib64jasper1 imagemagick use imagemagick with the ImageMagick-desktop icon default install of jasper, lib64jasper1 & imagemagick [root@localhost wilcal]# urpmi jasper Package jasper-1.900.1-15.mga4.x86_64 is already installed [root@localhost wilcal]# urpmi lib64jasper1 Package lib64jasper1-1.900.1-15.mga4.x86_64 is already installed [root@localhost wilcal]# urpmi imagemagick Package imagemagick-6.8.7.0-2.3.mga4.x86_64 is already installed I can open, and edit, a jpg image with the ImageMagick-desktop icon install jasper & lib64jasper1 from updates_testing [root@localhost wilcal]# urpmi jasper Package jasper-1.900.1-15.1.mga4.x86_64 is already installed [root@localhost wilcal]# urpmi lib64jasper1 Package lib64jasper1-1.900.1-15.1.mga4.x86_64 is already installed [root@localhost wilcal]# urpmi imagemagick Package imagemagick-6.8.7.0-2.3.mga4.x86_64 is already installed ( there are no updates to the imagemagick packages ) I can open, and edit, a jpg image with the ImageMagick-desktop icon Test platform: Intel Core i7-2600K Sandy Bridge 3.4GHz GIGABYTE GA-Z68X-UD3-B3 LGA 1155 MoBo GIGABYTE GV-N440D3-1GI Nvidia GeForce GT 440 (Fermi) 1GB RTL8111/8168B PCI Express 1Gbit Ethernet DRAM 16GB (4 x 4GB) Mageia 4 64-bit, Nvidia driver virtualbox-4.3.10-1.1.mga4.x86_64 virtualbox-guest-additions-4.3.10-1.1.mga4.x86_64
This update works fine. Testing complete for mga4 32-bit & 64-bit Validating the update. Could someone from the sysadmin team push this to updates. Thanks
Keywords: (none) => validated_updateWhiteboard: MGA4-32-OK => MGA4-32-OK MGA4-64-OKCC: (none) => sysadmin-bugs
Advisory uploaded.
Whiteboard: MGA4-32-OK MGA4-64-OK => has_procedure advisory MGA4-32-OK MGA4-64-OK
Summary: japser new security issue CVE-2014-9029 => jasper new security issue CVE-2014-9029
Upstream advisory: http://www.ocert.org/advisories/ocert-2014-009.html
Severity: normal => critical
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2014-0514.html
Status: NEW => RESOLVEDResolution: (none) => FIXED
Trying this on x86_64. ImageMagick functions work fine on a random JPEG image before update. Checking the references now for a PoC.
CC: (none) => tarazed25