An integer overflow vulnerability was found in jasper in jasimage.c triggered by parsing of a maliciously crafted file.
Upstream patch:
https://github.com/mdadams/jasper/commit/d42b2388f7f8e0332c846675133acea151fc557a
References:
http://seclists.org/oss-sec/2016/q4/470
An assertion failure was possible to trigger in jasseq2dcreate.
Upstream patch:
https://github.com/mdadams/jasper/commit/d42b2388f7f8e0332c846675133acea151fc557a
CVE assignment:
http://seclists.org/oss-sec/2016/q4/441