CVE-2018-9252

JasPer 2.0.14 permite una denegación de servicio (DoS) mediante una aserción alcanzable en la función jpc_abstorelstepsize en libjasper/jpc/jpc_enc.c.

An update that fixes 14 vulnerabilities is now available. This update for jasper fixes the following issues. Improved patch for already fixed issue. Fixed assert in calcstepsizes. Validate component depth bit. Check bounds in jas_seq2d_bindsub. Check bounds in jas_seq2d_bindsub. Check bounds in jas_seq2d_bindsub. Fixed heap base overflow in by checking components. Fixed reachable assertion in jpc_abstorelstepsize. Fixed null pointer deref in ras_putdatastd. Fixed mem leaks by registering jpc_unk_destroyparms. Fixed numchans mixup. Fixed heap based buffer over-read in jp2_encode. Fixed memory leak in jas_malloc.c. This update was imported from the SUSE:SLE-15:Update update project.