Disable the libjasper JPEG-2000 loader

gdk-pixbuf2.spec

@@ -2,7 +2,7 @@
 
 Name:           gdk-pixbuf2
 Version:        2.35.5
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        An image loading library
 
 License:        LGPLv2+
@@ -14,7 +14,6 @@ BuildRequires:  pkgconfig(gio-2.0) >= %{glib2_version}
 BuildRequires:  libpng-devel
 BuildRequires:  libjpeg-devel
 BuildRequires:  libtiff-devel
-BuildRequires:  jasper-devel
 BuildRequires:  pkgconfig(x11)
 BuildRequires:  pkgconfig(gobject-introspection-1.0) >= 0.9.3
 # gdk-pixbuf does a configure time check which uses the GIO mime
@@ -93,7 +92,7 @@ the functionality of the installed %{name} package.
 (if ! test -x configure; then NOCONFIGURE=1 ./autogen.sh; CONFIGFLAGS=--enable-gtk-doc; fi;
  %configure $CONFIGFLAGS             \
         --with-x11                   \
-        --with-libjasper             \
+        --without-libjasper          \
         --with-included-loaders=png  \
         --enable-installed-tests
 )
@@ -171,6 +170,9 @@ gdk-pixbuf-query-loaders-%{__isa_bits} --update-cache
 
 
 %changelog
+* Thu Sep 15 2016 Richard Hughes <rhughes@redhat.com> - 2.35.5-2
+- Disable the libjasper JPEG-2000 loader because it's horribly insecure.
+
 * Tue Sep 13 2016 Kalev Lember <klember@redhat.com> - 2.35.5-1
 - Update to 2.35.5
 - Don't set group tags