shield Security update for jasper

SUSE-SLE-Module-Basesystem-15-SP7-2025-3219

This update for jasper fixes the following issues: - CVE-2025-8835: missing range check in the JPEG-2000 (JPC) Encoder leads to assertion failure and crash when processing a malformed JPEG2000 image with an invalid `cblkwidth` parameter (bsc#1247904). - CVE-2025-8836: out-of-bounds array indexing in function `jas_image_chclrspc` leads to crash when processing a malformed image file with BMP output format and color space conversion (bsc#1247902). - CVE-2025-8837: missing operations in cleanup code of the JPEG-2000 (JPC) Encoder leads to use-after-free when processing malformed JPEG2000 images with certain debug levels enabled (bsc#1247901).

• Release Date
  Sep 15 2025
• References
  Bugzilla: 1247904, 1247901, 1247902
  CVEs: CVE-2025-8836, CVE-2025-8835, CVE-2025-8837
• Type
  security
• Severity
  moderate

cloud_download Downloads

Basesystem Module 15.7 s390x

• Packages
  jasper
  An Implementation of the JPEG-2000 Standard, Part 1

  2.0.14-150000.3.37.1 lock src

  libjasper4
  JPEG-2000 library

  2.0.14-150000.3.37.1 lock rpm

Basesystem Module 15.7 aarch64

• Packages
  jasper
  An Implementation of the JPEG-2000 Standard, Part 1

  2.0.14-150000.3.37.1 lock src

  libjasper4
  JPEG-2000 library

  2.0.14-150000.3.37.1 lock rpm

Basesystem Module 15.7 ppc64le

• Packages
  jasper
  An Implementation of the JPEG-2000 Standard, Part 1

  2.0.14-150000.3.37.1 lock src

  libjasper4
  JPEG-2000 library

  2.0.14-150000.3.37.1 lock rpm

Basesystem Module 15.7 x86_64

• Packages
  jasper
  An Implementation of the JPEG-2000 Standard, Part 1

  2.0.14-150000.3.37.1 lock src

  libjasper4
  JPEG-2000 library

  2.0.14-150000.3.37.1 lock rpm