ELA-361-1 jasper security update

heap overflow and null pointer access

2021-02-11

CVE-2021-26926

A heap buffer overflow vulnerability was discovered
in JasPer, through jp2_dec.c in the jp2_decode() function.

CVE-2021-26927

A null pointer access was discovered in JasPer, through
jp2_dec.c in the jp2_decode() function.

For Debian 8 jessie, these problems have been fixed in version 1.900.1-debian1-2.4+deb8u9.

We recommend that you upgrade your jasper packages.

Further information about Extended LTS security advisories can be found in the dedicated section of our website.