Advisory ROSA-SA-2023-2307

Software: jasper 2.0.14-5
OS: ROSA Virtualization 2.1

package_evr_string: jasper-2.0.14-5.rv3.src.rpm

CVE-ID: CVE-2020-27828
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC.: Special input provided by an attacker in jasper could cause an arbitrary write outside of the allowed range. This could potentially affect confidentiality, data integrity, or application availability.
CVE-STATUS: Resolved
CVE-REV: To close, run the yum update jasper command

CVE-ID: CVE-2021-26926
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC.: An out-of-bounds read problem was detected in the jp2_decode function, which may cause information disclosure or program crash.
CVE-STATUS: Fixed
CVE-REV: Run the yum update jasper command to close it

CVE-ID: CVE-2021-26927
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC.: Dereferencing a null pointer in jp2_decode to jp2_dec.c can cause program crash and denial of service.
CVE-STATUS: Fixed
CVE-REV: Run the yum update jasper command to close it