{"update": {"autokarma": true, "autotime": false, "stable_karma": 3, "stable_days": 0, "unstable_karma": -3, "require_bugs": true, "require_testcases": true, "display_name": "", "notes": "Security fix for CVE-2015-5203, CVE-2015-5221, CVE-2016-1867, CVE-2016-1577 and CVE-2016-2116.\n", "type": "security", "status": "stable", "request": null, "severity": "unspecified", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": true, "critpath_groups": null, "close_bugs": true, "date_submitted": "2016-08-12 06:42:26", "date_modified": null, "date_approved": null, "date_testing": "2016-08-12 19:45:11", "date_stable": "2016-08-15 18:35:08", "alias": "FEDORA-2016-7776983633", "test_gating_status": null, "from_tag": null, "date_pushed": "2016-08-15 18:35:08", "meets_testing_requirements": false, "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2016-7776983633", "title": "jasper-1.900.1-33.fc24", "version_hash": "5102ce73539a650edbf182bca7d504d4d3bb93ab", "release": {"name": "F24", "long_name": "Fedora 24", "version": "24", "id_prefix": "FEDORA", "branch": "f24", "dist_tag": "f24", "stable_tag": "f24-updates", "testing_tag": "f24-updates-testing", "candidate_tag": "f24-updates-candidate", "pending_signing_tag": "f24-signing-pending", "pending_testing_tag": "f24-updates-testing-pending", "pending_stable_tag": "f24-updates-pending", "override_tag": "f24-override", "mail_template": "fedora_errata_template", "state": "archived", "composed_by_bodhi": true, "create_automatic_updates": null, "package_manager": "dnf", "testing_repository": "updates-testing", "released_on": null, "eol": null, "setting_status": null}, "user": {"name": "jridky", "email": "jridky@redhat.com", "id": 3049, "avatar": "https://seccdn.libravatar.org/avatar/c671d4cc0255c21f5a4a5aa884af6c46ec5bc130cdeeb4db13d326e31163d030?s=24&d=retro", "openid": "jridky.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by jridky. ", "timestamp": "2016-08-12 06:42:26", "update_id": 64591, "user_id": 91, "id": 470428, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2016-08-12 20:53:32", "update_id": 64591, "user_id": 91, "id": 470773, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 1, "karma_critpath": 0, "text": "works for me", "timestamp": "2016-08-14 10:14:21", "update_id": 64591, "user_id": 739, "id": 471292, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "cserpentis", "email": "cserpentis@gmail.com", "id": 739, "avatar": "https://seccdn.libravatar.org/avatar/a3febfef42f58ed535f3c3a3cf9743653cd774dbb6e4554e2ce7c847d9802b6c?s=24&d=retro", "openid": "cserpentis.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "trust admins"}]}}, {"karma": 1, "karma_critpath": 0, "text": "LGTM", "timestamp": "2016-08-14 15:29:01", "update_id": 64591, "user_id": 918, "id": 471335, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "heikoada", "email": "ml@fedora-blog.de", "id": 918, "avatar": "https://seccdn.libravatar.org/avatar/d176747fdc8561348b1fc00f8f95f57b50bccc265cb1881f51706eb644bd8869?s=24&d=retro", "openid": "heikoada.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for stable by bodhi. ", "timestamp": "2016-08-14 17:21:19", "update_id": 64591, "user_id": 91, "id": 471344, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": 1, "karma_critpath": 0, "text": "works for me", "timestamp": "2016-08-14 17:21:21", "update_id": 64591, "user_id": 182, "id": 471345, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "hreindl", "email": "h.reindl@thelounge.net", "id": 182, "avatar": "https://seccdn.libravatar.org/avatar/664e0d25c0404b7a153b4dbc5dc1f3d1be6a2e9fd91115fbb929fe16a55d21d7?s=24&d=retro", "openid": "hreindl.id.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to stable.", "timestamp": "2016-08-15 21:27:16", "update_id": 64591, "user_id": 91, "id": 471765, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.fedoraproject.org", "groups": []}}, {"karma": -1, "karma_critpath": -1, "text": "This breaks gnome-software (and really, anything that tries to load files using gtk-pixbuf) and prevents it starting:\n\n    gnome-software: jas_stream.c:1044: mem_write: Assertion `ret == cnt' failed.\n\nGtkPixbuf actually depends on the -1 buffer size to support auto-expanding the memory buffer at runtime, so changing the API by making the field unsigned breaks as GTK then tries to allocate a huge buffer.", "timestamp": "2016-09-06 15:11:30", "update_id": 64591, "user_id": 595, "id": 483260, "bug_feedback": [{"karma": 0, "comment_id": 483260, "bug_id": 1314473, "bug": {"bug_id": 1314473, "title": "CVE-2016-2116 jasper: Memory leak in jas_iccprof_createfrombuf causing memory consumption [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 483260, "bug_id": 1314472, "bug": {"bug_id": 1314472, "title": "CVE-2016-2116 jasper: Memory leak in jas_iccprof_createfrombuf causing memory consumption", "security": true, "parent": true}}, {"karma": 0, "comment_id": 483260, "bug_id": 1314468, "bug": {"bug_id": 1314468, "title": "CVE-2016-1577 jasper: Double free vulnerability in jas_iccattrval_destroy [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 483260, "bug_id": 1314466, "bug": {"bug_id": 1314466, "title": "CVE-2016-1577 jasper: Double free vulnerability in jas_iccattrval_destroy", "security": true, "parent": true}}, {"karma": 0, "comment_id": 483260, "bug_id": 1298138, "bug": {"bug_id": 1298138, "title": "CVE-2016-1867 jasper: out-of-bounds read in the jpc_pi_nextcprl() function [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 483260, "bug_id": 1298135, "bug": {"bug_id": 1298135, "title": "CVE-2016-1867 jasper: out-of-bounds read in the jpc_pi_nextcprl() function", "security": true, "parent": true}}, {"karma": 0, "comment_id": 483260, "bug_id": 1255714, "bug": {"bug_id": 1255714, "title": "CVE-2015-5221 jasper: Use-after-free and double-free flaws in Jasper JPEG-2000 library [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 483260, "bug_id": 1255710, "bug": {"bug_id": 1255710, "title": "CVE-2015-5221 jasper: Use-after-free and double-free flaws in Jasper JPEG-2000 library", "security": true, "parent": true}}, {"karma": 0, "comment_id": 483260, "bug_id": 1254244, "bug": {"bug_id": 1254244, "title": "CVE-2015-5203 jasper: double free in jasper_image_stop_load() [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 483260, "bug_id": 1254242, "bug": {"bug_id": 1254242, "title": "CVE-2015-5203 jasper: double free in jasper_image_stop_load()", "security": true, "parent": true}}], "testcase_feedback": [], "user": {"name": "rhughes", "email": "rhughes@redhat.com", "id": 595, "avatar": "https://seccdn.libravatar.org/avatar/6c1841bdb9e0cd6215ad98e984278d629eaf158656eb64447eb8d43647178279?s=24&d=retro", "openid": "rhughes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitfontpackages"}, {"name": "trust admins"}]}}, {"karma": -1, "karma_critpath": 0, "text": "Users of the updated lib seem to very reliably crash.", "timestamp": "2016-09-14 20:32:37", "update_id": 64591, "user_id": 1218, "id": 488057, "bug_feedback": [{"karma": 0, "comment_id": 488057, "bug_id": 1314473, "bug": {"bug_id": 1314473, "title": "CVE-2016-2116 jasper: Memory leak in jas_iccprof_createfrombuf causing memory consumption [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 488057, "bug_id": 1314472, "bug": {"bug_id": 1314472, "title": "CVE-2016-2116 jasper: Memory leak in jas_iccprof_createfrombuf causing memory consumption", "security": true, "parent": true}}, {"karma": 0, "comment_id": 488057, "bug_id": 1314468, "bug": {"bug_id": 1314468, "title": "CVE-2016-1577 jasper: Double free vulnerability in jas_iccattrval_destroy [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 488057, "bug_id": 1314466, "bug": {"bug_id": 1314466, "title": "CVE-2016-1577 jasper: Double free vulnerability in jas_iccattrval_destroy", "security": true, "parent": true}}, {"karma": 0, "comment_id": 488057, "bug_id": 1298138, "bug": {"bug_id": 1298138, "title": "CVE-2016-1867 jasper: out-of-bounds read in the jpc_pi_nextcprl() function [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 488057, "bug_id": 1298135, "bug": {"bug_id": 1298135, "title": "CVE-2016-1867 jasper: out-of-bounds read in the jpc_pi_nextcprl() function", "security": true, "parent": true}}, {"karma": 0, "comment_id": 488057, "bug_id": 1255714, "bug": {"bug_id": 1255714, "title": "CVE-2015-5221 jasper: Use-after-free and double-free flaws in Jasper JPEG-2000 library [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 488057, "bug_id": 1255710, "bug": {"bug_id": 1255710, "title": "CVE-2015-5221 jasper: Use-after-free and double-free flaws in Jasper JPEG-2000 library", "security": true, "parent": true}}, {"karma": 0, "comment_id": 488057, "bug_id": 1254244, "bug": {"bug_id": 1254244, "title": "CVE-2015-5203 jasper: double free in jasper_image_stop_load() [fedora-all]", "security": true, "parent": false}}, {"karma": 0, "comment_id": 488057, "bug_id": 1254242, "bug": {"bug_id": 1254242, "title": "CVE-2015-5203 jasper: double free in jasper_image_stop_load()", "security": true, "parent": true}}], "testcase_feedback": [], "user": {"name": "mattdm", "email": "mattdm@mattdm.org", "id": 1218, "avatar": "https://seccdn.libravatar.org/avatar/068534faddd1e5a9df8c61a891e66b0ebecab952020aa0fc9ecb2a48911d52d3?s=24&d=retro", "openid": "mattdm.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "discussion-mods-ask"}, {"name": "discussion-mods-centos"}, {"name": "aws-fpl"}, {"name": "discussion-bots"}, {"name": "communishift-mattdm"}, {"name": "common-issues-triage"}, {"name": "admins"}, {"name": "fedora-socialmedia"}, {"name": "aws"}, {"name": "gitspins"}, {"name": "ambassadors"}, {"name": "accounts"}, {"name": "elections"}, {"name": "docs"}, {"name": "council"}, {"name": "aws-cloud-poc"}, {"name": "gitcloud-image-service"}, {"name": "aws-s3"}, {"name": "gitdockerfiles"}, {"name": "irc-support-operators"}, {"name": "signed_fpca"}, {"name": "yak_farmers"}, {"name": "ipausers"}, {"name": "aws-billing"}, {"name": "gitcouncil"}, {"name": "sysadmin"}, {"name": "fedorabugs"}, {"name": "magazine"}, {"name": "wikiedit"}, {"name": "marketing"}, {"name": "gitspin-kickstarts"}, {"name": "fedora-contributor"}, {"name": "fi-apprentice"}, {"name": "community-blog"}, {"name": "atomic-wg"}, {"name": "aws-fedoramirror"}, {"name": "sysadmin-analysis"}, {"name": "ask-fedora"}, {"name": "discussion-mods-project"}, {"name": "discussion-mods-help"}, {"name": "discussion-mods-ask-other"}, {"name": "fesco"}, {"name": "discourse-experiments"}, {"name": "ai-ml-sig-admin"}, {"name": "websites-apps-cms"}]}}], "builds": [{"nvr": "jasper-1.900.1-33.fc24", "signed": true, "release_id": 14, "type": "rpm", "epoch": 0}], "bugs": [{"bug_id": 1254242, "title": "CVE-2015-5203 jasper: double free in jasper_image_stop_load()", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 483260, "bug_id": 1254242, "comment": {"karma": -1, "karma_critpath": -1, "text": "This breaks gnome-software (and really, anything that tries to load files using gtk-pixbuf) and prevents it starting:\n\n    gnome-software: jas_stream.c:1044: mem_write: Assertion `ret == cnt' failed.\n\nGtkPixbuf actually depends on the -1 buffer size to support auto-expanding the memory buffer at runtime, so changing the API by making the field unsigned breaks as GTK then tries to allocate a huge buffer.", "timestamp": "2016-09-06 15:11:30", "update_id": 64591, "user_id": 595, "id": 483260, "testcase_feedback": [], "user": {"name": "rhughes", "email": "rhughes@redhat.com", "id": 595, "avatar": "https://seccdn.libravatar.org/avatar/6c1841bdb9e0cd6215ad98e984278d629eaf158656eb64447eb8d43647178279?s=24&d=retro", "openid": "rhughes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitfontpackages"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 484783, "bug_id": 1254242, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2016-09-09 07:26:22", "update_id": 64590, "user_id": 284, "id": 484783, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 488057, "bug_id": 1254242, "comment": {"karma": -1, "karma_critpath": 0, "text": "Users of the updated lib seem to very reliably crash.", "timestamp": "2016-09-14 20:32:37", "update_id": 64591, "user_id": 1218, "id": 488057, "testcase_feedback": [], "user": {"name": "mattdm", "email": "mattdm@mattdm.org", "id": 1218, "avatar": "https://seccdn.libravatar.org/avatar/068534faddd1e5a9df8c61a891e66b0ebecab952020aa0fc9ecb2a48911d52d3?s=24&d=retro", "openid": "mattdm.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "discussion-mods-ask"}, {"name": "discussion-mods-centos"}, {"name": "aws-fpl"}, {"name": "discussion-bots"}, {"name": "communishift-mattdm"}, {"name": "common-issues-triage"}, {"name": "admins"}, {"name": "fedora-socialmedia"}, {"name": "aws"}, {"name": "gitspins"}, {"name": "ambassadors"}, {"name": "accounts"}, {"name": "elections"}, {"name": "docs"}, {"name": "council"}, {"name": "aws-cloud-poc"}, {"name": "gitcloud-image-service"}, {"name": "aws-s3"}, {"name": "gitdockerfiles"}, {"name": "irc-support-operators"}, {"name": "signed_fpca"}, {"name": "yak_farmers"}, {"name": "ipausers"}, {"name": "aws-billing"}, {"name": "gitcouncil"}, {"name": "sysadmin"}, {"name": "fedorabugs"}, {"name": "magazine"}, {"name": "wikiedit"}, {"name": "marketing"}, {"name": "gitspin-kickstarts"}, {"name": "fedora-contributor"}, {"name": "fi-apprentice"}, {"name": "community-blog"}, {"name": "atomic-wg"}, {"name": "aws-fedoramirror"}, {"name": "sysadmin-analysis"}, {"name": "ask-fedora"}, {"name": "discussion-mods-project"}, {"name": "discussion-mods-help"}, {"name": "discussion-mods-ask-other"}, {"name": "fesco"}, {"name": "discourse-experiments"}, {"name": "ai-ml-sig-admin"}, {"name": "websites-apps-cms"}]}}}]}, {"bug_id": 1254244, "title": "CVE-2015-5203 jasper: double free in jasper_image_stop_load() [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 483260, "bug_id": 1254244, "comment": {"karma": -1, "karma_critpath": -1, "text": "This breaks gnome-software (and really, anything that tries to load files using gtk-pixbuf) and prevents it starting:\n\n    gnome-software: jas_stream.c:1044: mem_write: Assertion `ret == cnt' failed.\n\nGtkPixbuf actually depends on the -1 buffer size to support auto-expanding the memory buffer at runtime, so changing the API by making the field unsigned breaks as GTK then tries to allocate a huge buffer.", "timestamp": "2016-09-06 15:11:30", "update_id": 64591, "user_id": 595, "id": 483260, "testcase_feedback": [], "user": {"name": "rhughes", "email": "rhughes@redhat.com", "id": 595, "avatar": "https://seccdn.libravatar.org/avatar/6c1841bdb9e0cd6215ad98e984278d629eaf158656eb64447eb8d43647178279?s=24&d=retro", "openid": "rhughes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitfontpackages"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 484783, "bug_id": 1254244, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2016-09-09 07:26:22", "update_id": 64590, "user_id": 284, "id": 484783, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 488057, "bug_id": 1254244, "comment": {"karma": -1, "karma_critpath": 0, "text": "Users of the updated lib seem to very reliably crash.", "timestamp": "2016-09-14 20:32:37", "update_id": 64591, "user_id": 1218, "id": 488057, "testcase_feedback": [], "user": {"name": "mattdm", "email": "mattdm@mattdm.org", "id": 1218, "avatar": "https://seccdn.libravatar.org/avatar/068534faddd1e5a9df8c61a891e66b0ebecab952020aa0fc9ecb2a48911d52d3?s=24&d=retro", "openid": "mattdm.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "discussion-mods-ask"}, {"name": "discussion-mods-centos"}, {"name": "aws-fpl"}, {"name": "discussion-bots"}, {"name": "communishift-mattdm"}, {"name": "common-issues-triage"}, {"name": "admins"}, {"name": "fedora-socialmedia"}, {"name": "aws"}, {"name": "gitspins"}, {"name": "ambassadors"}, {"name": "accounts"}, {"name": "elections"}, {"name": "docs"}, {"name": "council"}, {"name": "aws-cloud-poc"}, {"name": "gitcloud-image-service"}, {"name": "aws-s3"}, {"name": "gitdockerfiles"}, {"name": "irc-support-operators"}, {"name": "signed_fpca"}, {"name": "yak_farmers"}, {"name": "ipausers"}, {"name": "aws-billing"}, {"name": "gitcouncil"}, {"name": "sysadmin"}, {"name": "fedorabugs"}, {"name": "magazine"}, {"name": "wikiedit"}, {"name": "marketing"}, {"name": "gitspin-kickstarts"}, {"name": "fedora-contributor"}, {"name": "fi-apprentice"}, {"name": "community-blog"}, {"name": "atomic-wg"}, {"name": "aws-fedoramirror"}, {"name": "sysadmin-analysis"}, {"name": "ask-fedora"}, {"name": "discussion-mods-project"}, {"name": "discussion-mods-help"}, {"name": "discussion-mods-ask-other"}, {"name": "fesco"}, {"name": "discourse-experiments"}, {"name": "ai-ml-sig-admin"}, {"name": "websites-apps-cms"}]}}}]}, {"bug_id": 1255710, "title": "CVE-2015-5221 jasper: Use-after-free and double-free flaws in Jasper JPEG-2000 library", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 483260, "bug_id": 1255710, "comment": {"karma": -1, "karma_critpath": -1, "text": "This breaks gnome-software (and really, anything that tries to load files using gtk-pixbuf) and prevents it starting:\n\n    gnome-software: jas_stream.c:1044: mem_write: Assertion `ret == cnt' failed.\n\nGtkPixbuf actually depends on the -1 buffer size to support auto-expanding the memory buffer at runtime, so changing the API by making the field unsigned breaks as GTK then tries to allocate a huge buffer.", "timestamp": "2016-09-06 15:11:30", "update_id": 64591, "user_id": 595, "id": 483260, "testcase_feedback": [], "user": {"name": "rhughes", "email": "rhughes@redhat.com", "id": 595, "avatar": "https://seccdn.libravatar.org/avatar/6c1841bdb9e0cd6215ad98e984278d629eaf158656eb64447eb8d43647178279?s=24&d=retro", "openid": "rhughes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitfontpackages"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 484783, "bug_id": 1255710, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2016-09-09 07:26:22", "update_id": 64590, "user_id": 284, "id": 484783, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 488057, "bug_id": 1255710, "comment": {"karma": -1, "karma_critpath": 0, "text": "Users of the updated lib seem to very reliably crash.", "timestamp": "2016-09-14 20:32:37", "update_id": 64591, "user_id": 1218, "id": 488057, "testcase_feedback": [], "user": {"name": "mattdm", "email": "mattdm@mattdm.org", "id": 1218, "avatar": "https://seccdn.libravatar.org/avatar/068534faddd1e5a9df8c61a891e66b0ebecab952020aa0fc9ecb2a48911d52d3?s=24&d=retro", "openid": "mattdm.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "discussion-mods-ask"}, {"name": "discussion-mods-centos"}, {"name": "aws-fpl"}, {"name": "discussion-bots"}, {"name": "communishift-mattdm"}, {"name": "common-issues-triage"}, {"name": "admins"}, {"name": "fedora-socialmedia"}, {"name": "aws"}, {"name": "gitspins"}, {"name": "ambassadors"}, {"name": "accounts"}, {"name": "elections"}, {"name": "docs"}, {"name": "council"}, {"name": "aws-cloud-poc"}, {"name": "gitcloud-image-service"}, {"name": "aws-s3"}, {"name": "gitdockerfiles"}, {"name": "irc-support-operators"}, {"name": "signed_fpca"}, {"name": "yak_farmers"}, {"name": "ipausers"}, {"name": "aws-billing"}, {"name": "gitcouncil"}, {"name": "sysadmin"}, {"name": "fedorabugs"}, {"name": "magazine"}, {"name": "wikiedit"}, {"name": "marketing"}, {"name": "gitspin-kickstarts"}, {"name": "fedora-contributor"}, {"name": "fi-apprentice"}, {"name": "community-blog"}, {"name": "atomic-wg"}, {"name": "aws-fedoramirror"}, {"name": "sysadmin-analysis"}, {"name": "ask-fedora"}, {"name": "discussion-mods-project"}, {"name": "discussion-mods-help"}, {"name": "discussion-mods-ask-other"}, {"name": "fesco"}, {"name": "discourse-experiments"}, {"name": "ai-ml-sig-admin"}, {"name": "websites-apps-cms"}]}}}]}, {"bug_id": 1255714, "title": "CVE-2015-5221 jasper: Use-after-free and double-free flaws in Jasper JPEG-2000 library [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 483260, "bug_id": 1255714, "comment": {"karma": -1, "karma_critpath": -1, "text": "This breaks gnome-software (and really, anything that tries to load files using gtk-pixbuf) and prevents it starting:\n\n    gnome-software: jas_stream.c:1044: mem_write: Assertion `ret == cnt' failed.\n\nGtkPixbuf actually depends on the -1 buffer size to support auto-expanding the memory buffer at runtime, so changing the API by making the field unsigned breaks as GTK then tries to allocate a huge buffer.", "timestamp": "2016-09-06 15:11:30", "update_id": 64591, "user_id": 595, "id": 483260, "testcase_feedback": [], "user": {"name": "rhughes", "email": "rhughes@redhat.com", "id": 595, "avatar": "https://seccdn.libravatar.org/avatar/6c1841bdb9e0cd6215ad98e984278d629eaf158656eb64447eb8d43647178279?s=24&d=retro", "openid": "rhughes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitfontpackages"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 484783, "bug_id": 1255714, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2016-09-09 07:26:22", "update_id": 64590, "user_id": 284, "id": 484783, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 488057, "bug_id": 1255714, "comment": {"karma": -1, "karma_critpath": 0, "text": "Users of the updated lib seem to very reliably crash.", "timestamp": "2016-09-14 20:32:37", "update_id": 64591, "user_id": 1218, "id": 488057, "testcase_feedback": [], "user": {"name": "mattdm", "email": "mattdm@mattdm.org", "id": 1218, "avatar": "https://seccdn.libravatar.org/avatar/068534faddd1e5a9df8c61a891e66b0ebecab952020aa0fc9ecb2a48911d52d3?s=24&d=retro", "openid": "mattdm.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "discussion-mods-ask"}, {"name": "discussion-mods-centos"}, {"name": "aws-fpl"}, {"name": "discussion-bots"}, {"name": "communishift-mattdm"}, {"name": "common-issues-triage"}, {"name": "admins"}, {"name": "fedora-socialmedia"}, {"name": "aws"}, {"name": "gitspins"}, {"name": "ambassadors"}, {"name": "accounts"}, {"name": "elections"}, {"name": "docs"}, {"name": "council"}, {"name": "aws-cloud-poc"}, {"name": "gitcloud-image-service"}, {"name": "aws-s3"}, {"name": "gitdockerfiles"}, {"name": "irc-support-operators"}, {"name": "signed_fpca"}, {"name": "yak_farmers"}, {"name": "ipausers"}, {"name": "aws-billing"}, {"name": "gitcouncil"}, {"name": "sysadmin"}, {"name": "fedorabugs"}, {"name": "magazine"}, {"name": "wikiedit"}, {"name": "marketing"}, {"name": "gitspin-kickstarts"}, {"name": "fedora-contributor"}, {"name": "fi-apprentice"}, {"name": "community-blog"}, {"name": "atomic-wg"}, {"name": "aws-fedoramirror"}, {"name": "sysadmin-analysis"}, {"name": "ask-fedora"}, {"name": "discussion-mods-project"}, {"name": "discussion-mods-help"}, {"name": "discussion-mods-ask-other"}, {"name": "fesco"}, {"name": "discourse-experiments"}, {"name": "ai-ml-sig-admin"}, {"name": "websites-apps-cms"}]}}}]}, {"bug_id": 1298135, "title": "CVE-2016-1867 jasper: out-of-bounds read in the jpc_pi_nextcprl() function", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 483260, "bug_id": 1298135, "comment": {"karma": -1, "karma_critpath": -1, "text": "This breaks gnome-software (and really, anything that tries to load files using gtk-pixbuf) and prevents it starting:\n\n    gnome-software: jas_stream.c:1044: mem_write: Assertion `ret == cnt' failed.\n\nGtkPixbuf actually depends on the -1 buffer size to support auto-expanding the memory buffer at runtime, so changing the API by making the field unsigned breaks as GTK then tries to allocate a huge buffer.", "timestamp": "2016-09-06 15:11:30", "update_id": 64591, "user_id": 595, "id": 483260, "testcase_feedback": [], "user": {"name": "rhughes", "email": "rhughes@redhat.com", "id": 595, "avatar": "https://seccdn.libravatar.org/avatar/6c1841bdb9e0cd6215ad98e984278d629eaf158656eb64447eb8d43647178279?s=24&d=retro", "openid": "rhughes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitfontpackages"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 484783, "bug_id": 1298135, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2016-09-09 07:26:22", "update_id": 64590, "user_id": 284, "id": 484783, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 488057, "bug_id": 1298135, "comment": {"karma": -1, "karma_critpath": 0, "text": "Users of the updated lib seem to very reliably crash.", "timestamp": "2016-09-14 20:32:37", "update_id": 64591, "user_id": 1218, "id": 488057, "testcase_feedback": [], "user": {"name": "mattdm", "email": "mattdm@mattdm.org", "id": 1218, "avatar": "https://seccdn.libravatar.org/avatar/068534faddd1e5a9df8c61a891e66b0ebecab952020aa0fc9ecb2a48911d52d3?s=24&d=retro", "openid": "mattdm.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "discussion-mods-ask"}, {"name": "discussion-mods-centos"}, {"name": "aws-fpl"}, {"name": "discussion-bots"}, {"name": "communishift-mattdm"}, {"name": "common-issues-triage"}, {"name": "admins"}, {"name": "fedora-socialmedia"}, {"name": "aws"}, {"name": "gitspins"}, {"name": "ambassadors"}, {"name": "accounts"}, {"name": "elections"}, {"name": "docs"}, {"name": "council"}, {"name": "aws-cloud-poc"}, {"name": "gitcloud-image-service"}, {"name": "aws-s3"}, {"name": "gitdockerfiles"}, {"name": "irc-support-operators"}, {"name": "signed_fpca"}, {"name": "yak_farmers"}, {"name": "ipausers"}, {"name": "aws-billing"}, {"name": "gitcouncil"}, {"name": "sysadmin"}, {"name": "fedorabugs"}, {"name": "magazine"}, {"name": "wikiedit"}, {"name": "marketing"}, {"name": "gitspin-kickstarts"}, {"name": "fedora-contributor"}, {"name": "fi-apprentice"}, {"name": "community-blog"}, {"name": "atomic-wg"}, {"name": "aws-fedoramirror"}, {"name": "sysadmin-analysis"}, {"name": "ask-fedora"}, {"name": "discussion-mods-project"}, {"name": "discussion-mods-help"}, {"name": "discussion-mods-ask-other"}, {"name": "fesco"}, {"name": "discourse-experiments"}, {"name": "ai-ml-sig-admin"}, {"name": "websites-apps-cms"}]}}}]}, {"bug_id": 1298138, "title": "CVE-2016-1867 jasper: out-of-bounds read in the jpc_pi_nextcprl() function [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 483260, "bug_id": 1298138, "comment": {"karma": -1, "karma_critpath": -1, "text": "This breaks gnome-software (and really, anything that tries to load files using gtk-pixbuf) and prevents it starting:\n\n    gnome-software: jas_stream.c:1044: mem_write: Assertion `ret == cnt' failed.\n\nGtkPixbuf actually depends on the -1 buffer size to support auto-expanding the memory buffer at runtime, so changing the API by making the field unsigned breaks as GTK then tries to allocate a huge buffer.", "timestamp": "2016-09-06 15:11:30", "update_id": 64591, "user_id": 595, "id": 483260, "testcase_feedback": [], "user": {"name": "rhughes", "email": "rhughes@redhat.com", "id": 595, "avatar": "https://seccdn.libravatar.org/avatar/6c1841bdb9e0cd6215ad98e984278d629eaf158656eb64447eb8d43647178279?s=24&d=retro", "openid": "rhughes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitfontpackages"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 484783, "bug_id": 1298138, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2016-09-09 07:26:22", "update_id": 64590, "user_id": 284, "id": 484783, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 488057, "bug_id": 1298138, "comment": {"karma": -1, "karma_critpath": 0, "text": "Users of the updated lib seem to very reliably crash.", "timestamp": "2016-09-14 20:32:37", "update_id": 64591, "user_id": 1218, "id": 488057, "testcase_feedback": [], "user": {"name": "mattdm", "email": "mattdm@mattdm.org", "id": 1218, "avatar": "https://seccdn.libravatar.org/avatar/068534faddd1e5a9df8c61a891e66b0ebecab952020aa0fc9ecb2a48911d52d3?s=24&d=retro", "openid": "mattdm.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "discussion-mods-ask"}, {"name": "discussion-mods-centos"}, {"name": "aws-fpl"}, {"name": "discussion-bots"}, {"name": "communishift-mattdm"}, {"name": "common-issues-triage"}, {"name": "admins"}, {"name": "fedora-socialmedia"}, {"name": "aws"}, {"name": "gitspins"}, {"name": "ambassadors"}, {"name": "accounts"}, {"name": "elections"}, {"name": "docs"}, {"name": "council"}, {"name": "aws-cloud-poc"}, {"name": "gitcloud-image-service"}, {"name": "aws-s3"}, {"name": "gitdockerfiles"}, {"name": "irc-support-operators"}, {"name": "signed_fpca"}, {"name": "yak_farmers"}, {"name": "ipausers"}, {"name": "aws-billing"}, {"name": "gitcouncil"}, {"name": "sysadmin"}, {"name": "fedorabugs"}, {"name": "magazine"}, {"name": "wikiedit"}, {"name": "marketing"}, {"name": "gitspin-kickstarts"}, {"name": "fedora-contributor"}, {"name": "fi-apprentice"}, {"name": "community-blog"}, {"name": "atomic-wg"}, {"name": "aws-fedoramirror"}, {"name": "sysadmin-analysis"}, {"name": "ask-fedora"}, {"name": "discussion-mods-project"}, {"name": "discussion-mods-help"}, {"name": "discussion-mods-ask-other"}, {"name": "fesco"}, {"name": "discourse-experiments"}, {"name": "ai-ml-sig-admin"}, {"name": "websites-apps-cms"}]}}}]}, {"bug_id": 1314466, "title": "CVE-2016-1577 jasper: Double free vulnerability in jas_iccattrval_destroy", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 483260, "bug_id": 1314466, "comment": {"karma": -1, "karma_critpath": -1, "text": "This breaks gnome-software (and really, anything that tries to load files using gtk-pixbuf) and prevents it starting:\n\n    gnome-software: jas_stream.c:1044: mem_write: Assertion `ret == cnt' failed.\n\nGtkPixbuf actually depends on the -1 buffer size to support auto-expanding the memory buffer at runtime, so changing the API by making the field unsigned breaks as GTK then tries to allocate a huge buffer.", "timestamp": "2016-09-06 15:11:30", "update_id": 64591, "user_id": 595, "id": 483260, "testcase_feedback": [], "user": {"name": "rhughes", "email": "rhughes@redhat.com", "id": 595, "avatar": "https://seccdn.libravatar.org/avatar/6c1841bdb9e0cd6215ad98e984278d629eaf158656eb64447eb8d43647178279?s=24&d=retro", "openid": "rhughes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitfontpackages"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 484783, "bug_id": 1314466, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2016-09-09 07:26:22", "update_id": 64590, "user_id": 284, "id": 484783, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 488057, "bug_id": 1314466, "comment": {"karma": -1, "karma_critpath": 0, "text": "Users of the updated lib seem to very reliably crash.", "timestamp": "2016-09-14 20:32:37", "update_id": 64591, "user_id": 1218, "id": 488057, "testcase_feedback": [], "user": {"name": "mattdm", "email": "mattdm@mattdm.org", "id": 1218, "avatar": "https://seccdn.libravatar.org/avatar/068534faddd1e5a9df8c61a891e66b0ebecab952020aa0fc9ecb2a48911d52d3?s=24&d=retro", "openid": "mattdm.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "discussion-mods-ask"}, {"name": "discussion-mods-centos"}, {"name": "aws-fpl"}, {"name": "discussion-bots"}, {"name": "communishift-mattdm"}, {"name": "common-issues-triage"}, {"name": "admins"}, {"name": "fedora-socialmedia"}, {"name": "aws"}, {"name": "gitspins"}, {"name": "ambassadors"}, {"name": "accounts"}, {"name": "elections"}, {"name": "docs"}, {"name": "council"}, {"name": "aws-cloud-poc"}, {"name": "gitcloud-image-service"}, {"name": "aws-s3"}, {"name": "gitdockerfiles"}, {"name": "irc-support-operators"}, {"name": "signed_fpca"}, {"name": "yak_farmers"}, {"name": "ipausers"}, {"name": "aws-billing"}, {"name": "gitcouncil"}, {"name": "sysadmin"}, {"name": "fedorabugs"}, {"name": "magazine"}, {"name": "wikiedit"}, {"name": "marketing"}, {"name": "gitspin-kickstarts"}, {"name": "fedora-contributor"}, {"name": "fi-apprentice"}, {"name": "community-blog"}, {"name": "atomic-wg"}, {"name": "aws-fedoramirror"}, {"name": "sysadmin-analysis"}, {"name": "ask-fedora"}, {"name": "discussion-mods-project"}, {"name": "discussion-mods-help"}, {"name": "discussion-mods-ask-other"}, {"name": "fesco"}, {"name": "discourse-experiments"}, {"name": "ai-ml-sig-admin"}, {"name": "websites-apps-cms"}]}}}]}, {"bug_id": 1314468, "title": "CVE-2016-1577 jasper: Double free vulnerability in jas_iccattrval_destroy [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 483260, "bug_id": 1314468, "comment": {"karma": -1, "karma_critpath": -1, "text": "This breaks gnome-software (and really, anything that tries to load files using gtk-pixbuf) and prevents it starting:\n\n    gnome-software: jas_stream.c:1044: mem_write: Assertion `ret == cnt' failed.\n\nGtkPixbuf actually depends on the -1 buffer size to support auto-expanding the memory buffer at runtime, so changing the API by making the field unsigned breaks as GTK then tries to allocate a huge buffer.", "timestamp": "2016-09-06 15:11:30", "update_id": 64591, "user_id": 595, "id": 483260, "testcase_feedback": [], "user": {"name": "rhughes", "email": "rhughes@redhat.com", "id": 595, "avatar": "https://seccdn.libravatar.org/avatar/6c1841bdb9e0cd6215ad98e984278d629eaf158656eb64447eb8d43647178279?s=24&d=retro", "openid": "rhughes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitfontpackages"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 484783, "bug_id": 1314468, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2016-09-09 07:26:22", "update_id": 64590, "user_id": 284, "id": 484783, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 488057, "bug_id": 1314468, "comment": {"karma": -1, "karma_critpath": 0, "text": "Users of the updated lib seem to very reliably crash.", "timestamp": "2016-09-14 20:32:37", "update_id": 64591, "user_id": 1218, "id": 488057, "testcase_feedback": [], "user": {"name": "mattdm", "email": "mattdm@mattdm.org", "id": 1218, "avatar": "https://seccdn.libravatar.org/avatar/068534faddd1e5a9df8c61a891e66b0ebecab952020aa0fc9ecb2a48911d52d3?s=24&d=retro", "openid": "mattdm.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "discussion-mods-ask"}, {"name": "discussion-mods-centos"}, {"name": "aws-fpl"}, {"name": "discussion-bots"}, {"name": "communishift-mattdm"}, {"name": "common-issues-triage"}, {"name": "admins"}, {"name": "fedora-socialmedia"}, {"name": "aws"}, {"name": "gitspins"}, {"name": "ambassadors"}, {"name": "accounts"}, {"name": "elections"}, {"name": "docs"}, {"name": "council"}, {"name": "aws-cloud-poc"}, {"name": "gitcloud-image-service"}, {"name": "aws-s3"}, {"name": "gitdockerfiles"}, {"name": "irc-support-operators"}, {"name": "signed_fpca"}, {"name": "yak_farmers"}, {"name": "ipausers"}, {"name": "aws-billing"}, {"name": "gitcouncil"}, {"name": "sysadmin"}, {"name": "fedorabugs"}, {"name": "magazine"}, {"name": "wikiedit"}, {"name": "marketing"}, {"name": "gitspin-kickstarts"}, {"name": "fedora-contributor"}, {"name": "fi-apprentice"}, {"name": "community-blog"}, {"name": "atomic-wg"}, {"name": "aws-fedoramirror"}, {"name": "sysadmin-analysis"}, {"name": "ask-fedora"}, {"name": "discussion-mods-project"}, {"name": "discussion-mods-help"}, {"name": "discussion-mods-ask-other"}, {"name": "fesco"}, {"name": "discourse-experiments"}, {"name": "ai-ml-sig-admin"}, {"name": "websites-apps-cms"}]}}}]}, {"bug_id": 1314472, "title": "CVE-2016-2116 jasper: Memory leak in jas_iccprof_createfrombuf causing memory consumption", "security": true, "parent": true, "feedback": [{"karma": 0, "comment_id": 483260, "bug_id": 1314472, "comment": {"karma": -1, "karma_critpath": -1, "text": "This breaks gnome-software (and really, anything that tries to load files using gtk-pixbuf) and prevents it starting:\n\n    gnome-software: jas_stream.c:1044: mem_write: Assertion `ret == cnt' failed.\n\nGtkPixbuf actually depends on the -1 buffer size to support auto-expanding the memory buffer at runtime, so changing the API by making the field unsigned breaks as GTK then tries to allocate a huge buffer.", "timestamp": "2016-09-06 15:11:30", "update_id": 64591, "user_id": 595, "id": 483260, "testcase_feedback": [], "user": {"name": "rhughes", "email": "rhughes@redhat.com", "id": 595, "avatar": "https://seccdn.libravatar.org/avatar/6c1841bdb9e0cd6215ad98e984278d629eaf158656eb64447eb8d43647178279?s=24&d=retro", "openid": "rhughes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitfontpackages"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 484783, "bug_id": 1314472, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2016-09-09 07:26:22", "update_id": 64590, "user_id": 284, "id": 484783, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 488057, "bug_id": 1314472, "comment": {"karma": -1, "karma_critpath": 0, "text": "Users of the updated lib seem to very reliably crash.", "timestamp": "2016-09-14 20:32:37", "update_id": 64591, "user_id": 1218, "id": 488057, "testcase_feedback": [], "user": {"name": "mattdm", "email": "mattdm@mattdm.org", "id": 1218, "avatar": "https://seccdn.libravatar.org/avatar/068534faddd1e5a9df8c61a891e66b0ebecab952020aa0fc9ecb2a48911d52d3?s=24&d=retro", "openid": "mattdm.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "discussion-mods-ask"}, {"name": "discussion-mods-centos"}, {"name": "aws-fpl"}, {"name": "discussion-bots"}, {"name": "communishift-mattdm"}, {"name": "common-issues-triage"}, {"name": "admins"}, {"name": "fedora-socialmedia"}, {"name": "aws"}, {"name": "gitspins"}, {"name": "ambassadors"}, {"name": "accounts"}, {"name": "elections"}, {"name": "docs"}, {"name": "council"}, {"name": "aws-cloud-poc"}, {"name": "gitcloud-image-service"}, {"name": "aws-s3"}, {"name": "gitdockerfiles"}, {"name": "irc-support-operators"}, {"name": "signed_fpca"}, {"name": "yak_farmers"}, {"name": "ipausers"}, {"name": "aws-billing"}, {"name": "gitcouncil"}, {"name": "sysadmin"}, {"name": "fedorabugs"}, {"name": "magazine"}, {"name": "wikiedit"}, {"name": "marketing"}, {"name": "gitspin-kickstarts"}, {"name": "fedora-contributor"}, {"name": "fi-apprentice"}, {"name": "community-blog"}, {"name": "atomic-wg"}, {"name": "aws-fedoramirror"}, {"name": "sysadmin-analysis"}, {"name": "ask-fedora"}, {"name": "discussion-mods-project"}, {"name": "discussion-mods-help"}, {"name": "discussion-mods-ask-other"}, {"name": "fesco"}, {"name": "discourse-experiments"}, {"name": "ai-ml-sig-admin"}, {"name": "websites-apps-cms"}]}}}]}, {"bug_id": 1314473, "title": "CVE-2016-2116 jasper: Memory leak in jas_iccprof_createfrombuf causing memory consumption [fedora-all]", "security": true, "parent": false, "feedback": [{"karma": 0, "comment_id": 483260, "bug_id": 1314473, "comment": {"karma": -1, "karma_critpath": -1, "text": "This breaks gnome-software (and really, anything that tries to load files using gtk-pixbuf) and prevents it starting:\n\n    gnome-software: jas_stream.c:1044: mem_write: Assertion `ret == cnt' failed.\n\nGtkPixbuf actually depends on the -1 buffer size to support auto-expanding the memory buffer at runtime, so changing the API by making the field unsigned breaks as GTK then tries to allocate a huge buffer.", "timestamp": "2016-09-06 15:11:30", "update_id": 64591, "user_id": 595, "id": 483260, "testcase_feedback": [], "user": {"name": "rhughes", "email": "rhughes@redhat.com", "id": 595, "avatar": "https://seccdn.libravatar.org/avatar/6c1841bdb9e0cd6215ad98e984278d629eaf158656eb64447eb8d43647178279?s=24&d=retro", "openid": "rhughes.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "provenpackager"}, {"name": "ipausers"}, {"name": "fedora-contributor"}, {"name": "signed_fpca"}, {"name": "fedorabugs"}, {"name": "hosted-content"}, {"name": "gitfontpackages"}, {"name": "trust admins"}]}}}, {"karma": 0, "comment_id": 484783, "bug_id": 1314473, "comment": {"karma": 1, "karma_critpath": 0, "text": "", "timestamp": "2016-09-09 07:26:22", "update_id": 64590, "user_id": 284, "id": 484783, "testcase_feedback": [], "user": {"name": "cairo", "email": "hansmueller183@yahoo.com", "id": 284, "avatar": "https://seccdn.libravatar.org/avatar/65ac01c684e76450d8575348b4894728e9c69ffdbd7c08718a4156e8e0daf5b6?s=24&d=retro", "openid": "cairo.id.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 488057, "bug_id": 1314473, "comment": {"karma": -1, "karma_critpath": 0, "text": "Users of the updated lib seem to very reliably crash.", "timestamp": "2016-09-14 20:32:37", "update_id": 64591, "user_id": 1218, "id": 488057, "testcase_feedback": [], "user": {"name": "mattdm", "email": "mattdm@mattdm.org", "id": 1218, "avatar": "https://seccdn.libravatar.org/avatar/068534faddd1e5a9df8c61a891e66b0ebecab952020aa0fc9ecb2a48911d52d3?s=24&d=retro", "openid": "mattdm.id.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "discussion-mods-ask"}, {"name": "discussion-mods-centos"}, {"name": "aws-fpl"}, {"name": "discussion-bots"}, {"name": "communishift-mattdm"}, {"name": "common-issues-triage"}, {"name": "admins"}, {"name": "fedora-socialmedia"}, {"name": "aws"}, {"name": "gitspins"}, {"name": "ambassadors"}, {"name": "accounts"}, {"name": "elections"}, {"name": "docs"}, {"name": "council"}, {"name": "aws-cloud-poc"}, {"name": "gitcloud-image-service"}, {"name": "aws-s3"}, {"name": "gitdockerfiles"}, {"name": "irc-support-operators"}, {"name": "signed_fpca"}, {"name": "yak_farmers"}, {"name": "ipausers"}, {"name": "aws-billing"}, {"name": "gitcouncil"}, {"name": "sysadmin"}, {"name": "fedorabugs"}, {"name": "magazine"}, {"name": "wikiedit"}, {"name": "marketing"}, {"name": "gitspin-kickstarts"}, {"name": "fedora-contributor"}, {"name": "fi-apprentice"}, {"name": "community-blog"}, {"name": "atomic-wg"}, {"name": "aws-fedoramirror"}, {"name": "sysadmin-analysis"}, {"name": "ask-fedora"}, {"name": "discussion-mods-project"}, {"name": "discussion-mods-help"}, {"name": "discussion-mods-ask-other"}, {"name": "fesco"}, {"name": "discourse-experiments"}, {"name": "ai-ml-sig-admin"}, {"name": "websites-apps-cms"}]}}}]}], "updateid": "FEDORA-2016-7776983633", "karma": 1, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}