According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the way JasPer decoded     JPEG 2000 image files. A specially crafted file could     cause an application using JasPer to crash or,     possibly, execute arbitrary code. (CVE-2016-8654,     CVE-2016-9560, CVE-2016-10249, CVE-2015-5203,     CVE-2015-5221, CVE-2016-1577, CVE-2016-8690,     CVE-2016-8693, CVE-2016-8884, CVE-2016-8885,     CVE-2016-9262, CVE-2016-9591)

  - Multiple flaws were found in the way JasPer decoded     JPEG 2000 image files. A specially crafted file could     cause an application using JasPer to crash.
    (CVE-2016-1867, CVE-2016-2089, CVE-2016-2116,     CVE-2016-8691, CVE-2016-8692, CVE-2016-8883,     CVE-2016-9387, CVE-2016-9388, CVE-2016-9389,     CVE-2016-9390, CVE-2016-9391, CVE-2016-9392,     CVE-2016-9393, CVE-2016-9394, CVE-2016-9583,     CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper to version 1.900.14 fixes several issues.

These security issues were fixed :

  - CVE-2008-3522: Buffer overflow in the jas_stream_printf     function in libjasper/base/jas_stream.c in JasPer might     have allowed context-dependent attackers to have an     unknown impact via vectors related to the mif_hdr_put     function and use of vsprintf (bsc#392410)

  - CVE-2015-5203: Double free corruption in JasPer     JPEG-2000 implementation (bsc#941919).

  - CVE-2015-5221: Use-after-free (and double-free) in     Jasper JPEG-200 (bsc#942553).

  - CVE-2016-1577: Double free vulnerability in the     jas_iccattrval_destroy function in JasPer allowed remote     attackers to cause a denial of service (crash) or     possibly execute arbitrary code via a crafted ICC color     profile in a JPEG 2000 image file, a different     vulnerability than CVE-2014-8137 (bsc#968373).

  - CVE-2016-2116: Memory leak in the     jas_iccprof_createfrombuf function in JasPer allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted ICC color profile in a JPEG     2000 image file (bsc#968373)

  - CVE-2016-8690: NULL pointer dereference in bmp_getdata     triggered by crafted BMP image (bsc#1005084).

  - CVE-2016-8691, CVE-2016-8692: Missing range check on     XRsiz and YRsiz fields of SIZ marker segment     (bsc#1005090).

  - CVE-2016-8693: The memory stream interface allowed for a     buffer size of zero. The case of a zero-sized buffer was     not handled correctly, as it could lead to a double free     (bsc#1005242).

  - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox()     (bsc#1006591).

  - CVE-2016-8881: Heap overflow in jpc_getuint16()     (bsc#1006593).

  - CVE-2016-8882: NULL pointer access in jpc_pi_destroy     (bsc#1006597).

  - CVE-2016-8883: Assert triggered in jpc_dec_tiledecode()     (bsc#1006598).

  - CVE-2016-8886: Memory allocation failure in jas_malloc     (jas_malloc.c) (bsc#1006599).

For additional change description please have a look at the changelog.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-1208 advisory.

    - Multiple security fixes (fixed by thoger):
      CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089       CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692       CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262       CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391       CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583       CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
    - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183672)
    - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183680)
    - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173567)
    - CVE-2014-8138 - heap overflow in jp2_decode (#1173567)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for jasper is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.

Security Fix(es) :

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2016-8654, CVE-2016-9560, CVE-2016-10249, CVE-2015-5203, CVE-2015-5221, CVE-2016-1577, CVE-2016-8690, CVE-2016-8693, CVE-2016-8884, CVE-2016-8885, CVE-2016-9262, CVE-2016-9591)

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. (CVE-2016-1867, CVE-2016-2089, CVE-2016-2116, CVE-2016-8691, CVE-2016-8692, CVE-2016-8883, CVE-2016-9387, CVE-2016-9388, CVE-2016-9389, CVE-2016-9390, CVE-2016-9391, CVE-2016-9392, CVE-2016-9393, CVE-2016-9394, CVE-2016-9583, CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)

Red Hat would like to thank Liu Bingchang (IIE) for reporting CVE-2016-8654, CVE-2016-9583, CVE-2016-9591, and CVE-2016-9600;
Gustavo Grieco for reporting CVE-2015-5203; and Josselin Feist for reporting CVE-2015-5221.

An update for jasper is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.

Security Fix(es) :

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2016-8654, CVE-2016-9560, CVE-2016-10249, CVE-2015-5203, CVE-2015-5221, CVE-2016-1577, CVE-2016-8690, CVE-2016-8693, CVE-2016-8884, CVE-2016-8885, CVE-2016-9262, CVE-2016-9591)

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash. (CVE-2016-1867, CVE-2016-2089, CVE-2016-2116, CVE-2016-8691, CVE-2016-8692, CVE-2016-8883, CVE-2016-9387, CVE-2016-9388, CVE-2016-9389, CVE-2016-9390, CVE-2016-9391, CVE-2016-9392, CVE-2016-9393, CVE-2016-9394, CVE-2016-9583, CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)

Red Hat would like to thank Liu Bingchang (IIE) for reporting CVE-2016-8654, CVE-2016-9583, CVE-2016-9591, and CVE-2016-9600;
Gustavo Grieco for reporting CVE-2015-5203; and Josselin Feist for reporting CVE-2015-5221.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper to version 1.900.14 fixes several issues.

These security issues were fixed :

  - CVE-2008-3522: Buffer overflow in the jas_stream_printf     function in libjasper/base/jas_stream.c in JasPer might     have allowed context-dependent attackers to have an     unknown impact via vectors related to the mif_hdr_put     function and use of vsprintf (bsc#392410)

  - CVE-2015-5203: Double free corruption in JasPer     JPEG-2000 implementation (bsc#941919).

  - CVE-2015-5221: Use-after-free (and double-free) in     Jasper JPEG-200 (bsc#942553).

  - CVE-2016-1577: Double free vulnerability in the     jas_iccattrval_destroy function in JasPer allowed remote     attackers to cause a denial of service (crash) or     possibly execute arbitrary code via a crafted ICC color     profile in a JPEG 2000 image file, a different     vulnerability than CVE-2014-8137 (bsc#968373).

  - CVE-2016-2116: Memory leak in the     jas_iccprof_createfrombuf function in JasPer allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted ICC color profile in a JPEG     2000 image file (bsc#968373)

  - CVE-2016-8690: NULL pointer dereference in bmp_getdata     triggered by crafted BMP image (bsc#1005084).

  - CVE-2016-8691, CVE-2016-8692: Missing range check on     XRsiz and YRsiz fields of SIZ marker segment     (bsc#1005090).

  - CVE-2016-8693: The memory stream interface allowed for a     buffer size of zero. The case of a zero-sized buffer was     not handled correctly, as it could lead to a double free     (bsc#1005242).

  - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox()     (bsc#1006591).

  - CVE-2016-8881: Heap overflow in jpc_getuint16()     (bsc#1006593).

  - CVE-2016-8882: NULL pointer access in jpc_pi_destroy     (bsc#1006597).

  - CVE-2016-8883: Assert triggered in jpc_dec_tiledecode()     (bsc#1006598).

  - CVE-2016-8886: Memory allocation failure in jas_malloc     (jas_malloc.c) (bsc#1006599).

    For additional change description please have a look at     the changelog.

This update for jasper to version 1.900.14 fixes several issues. These security issues were fixed :

  - CVE-2016-8887: NULL pointer dereference in     jp2_colr_destroy (jp2_cod.c) (bsc#1006836)

  - CVE-2016-8886: memory allocation failure in jas_malloc     (jas_malloc.c) (bsc#1006599)

  - CVE-2016-8884,CVE-2016-8885: two NULL pointer     dereferences in bmp_getdata (incomplete fix for     CVE-2016-8690) (bsc#1007009)

  - CVE-2016-8883: assert in jpc_dec_tiledecode()     (bsc#1006598)

  - CVE-2016-8882: segfault / NULL pointer access in     jpc_pi_destroy (bsc#1006597)

  - CVE-2016-8881: Heap overflow in jpc_getuint16()     (bsc#1006593)

  - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox()     (bsc#1006591)

  - CVE-2016-8693 Double free vulnerability in mem_close     (bsc#1005242)

  - CVE-2016-8691, CVE-2016-8692: Divide by zero in     jpc_dec_process_siz (bsc#1005090)

  - CVE-2016-8690: NULL pointer dereference in bmp_getdata     triggered by crafted BMP image (bsc#1005084)

  - CVE-2016-2116: Memory leak in the     jas_iccprof_createfrombuf function in JasPer allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted ICC color profile in a JPEG     2000 image file (bsc#968373)

  - CVE-2016-2089: invalid read in the JasPer's     jas_matrix_clip() function (bsc#963983)

  - CVE-2016-1867: Out-of-bounds Read in the JasPer's     jpc_pi_nextcprl() function (bsc#961886)

  - CVE-2015-5221: Use-after-free (and double-free) in     Jasper JPEG-200 (bsc#942553).

  - CVE-2015-5203: Double free corruption in JasPer     JPEG-2000 implementation (bsc#941919)

  - CVE-2008-3522: Buffer overflow in the jas_stream_printf     function in libjasper/base/jas_stream.c in JasPer might     have allowed context-dependent attackers to have an     unknown impact via vectors related to the mif_hdr_put     function and use of vsprintf (bsc#392410)

  - jasper: NULL pointer dereference in jp2_colr_destroy     (jp2_cod.c) (incomplete fix for CVE-2016-8887)     (bsc#1006839) For additional change description please     have a look at the changelog.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper to version 1.900.14 fixes several issues.

These security issues were fixed :

  - CVE-2016-8887: NULL pointer dereference in     jp2_colr_destroy (jp2_cod.c) (bsc#1006836)

  - CVE-2016-8886: memory allocation failure in jas_malloc     (jas_malloc.c) (bsc#1006599)

  - CVE-2016-8884,CVE-2016-8885: two NULL pointer     dereferences in bmp_getdata (incomplete fix for     CVE-2016-8690) (bsc#1007009)

  - CVE-2016-8883: assert in jpc_dec_tiledecode()     (bsc#1006598)

  - CVE-2016-8882: segfault / NULL pointer access in     jpc_pi_destroy (bsc#1006597)

  - CVE-2016-8881: Heap overflow in jpc_getuint16()     (bsc#1006593)

  - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox()     (bsc#1006591)

  - CVE-2016-8693 Double free vulnerability in mem_close     (bsc#1005242)

  - CVE-2016-8691, CVE-2016-8692: Divide by zero in     jpc_dec_process_siz (bsc#1005090)

  - CVE-2016-8690: NULL pointer dereference in bmp_getdata     triggered by crafted BMP image (bsc#1005084)

  - CVE-2016-2116: Memory leak in the     jas_iccprof_createfrombuf function in JasPer allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted ICC color profile in a JPEG     2000 image file (bsc#968373) 

  - CVE-2016-2089: invalid read in the JasPer's     jas_matrix_clip() function (bsc#963983)

  - CVE-2016-1867: Out-of-bounds Read in the JasPer's     jpc_pi_nextcprl() function (bsc#961886)

  - CVE-2015-5221: Use-after-free (and double-free) in     Jasper JPEG-200 (bsc#942553).

  - CVE-2015-5203: Double free corruption in JasPer     JPEG-2000 implementation (bsc#941919)

  - CVE-2008-3522: Buffer overflow in the jas_stream_printf     function in libjasper/base/jas_stream.c in JasPer might     have allowed context-dependent attackers to have an     unknown impact via vectors related to the mif_hdr_put     function and use of vsprintf (bsc#392410)

  - jasper: NULL pointer dereference in jp2_colr_destroy     (jp2_cod.c) (incomplete fix for CVE-2016-8887)     (bsc#1006839)

For additional change description please have a look at the changelog.

This update was imported from the SUSE:SLE-12:Update update project.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2919-1 advisory.

    Jacob Baines discovered that JasPer incorrectly handled ICC color profiles in JPEG-2000 image files. If a     user were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause     JasPer to crash or possibly execute arbitrary code with user privileges. (CVE-2016-1577)

    Tyler Hicks discovered that JasPer incorrectly handled memory when processing JPEG-2000 image files. If a     user were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause     JasPer to consume memory, resulting in a denial of service. (CVE-2016-2116)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in JasPer, a library for manipulating JPEG-2000 files. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2016-1577     Jacob Baines discovered a double-free flaw in the     jas_iccattrval_destroy function. A remote attacker could     exploit this flaw to cause an application using the     JasPer library to crash, or potentially, to execute     arbitrary code with the privileges of the user running     the application.

  - CVE-2016-2089     The Qihoo 360 Codesafe Team discovered a NULL pointer     dereference flaw within the jas_matrix_clip function. A     remote attacker could exploit this flaw to cause an     application using the JasPer library to crash, resulting     in a denial-of-service.

  - CVE-2016-2116     Tyler Hicks discovered a memory leak flaw in the     jas_iccprof_createfrombuf function. A remote attacker     could exploit this flaw to cause the JasPer library to     consume memory, resulting in a denial-of-service.

ID	名稱	產品	系列	已發布	已更新	嚴重性
100811	EulerOS 2.0 SP1 : jasper (EulerOS-SA-2017-1094)	Nessus	Huawei Local Security Checks	2017/6/16	2025/12/16	high
94596	openSUSE Security Update : jasper (openSUSE-2016-1263)	Nessus	SuSE Local Security Checks	2016/11/7	2026/1/20	high
100089	Oracle Linux 6 / 7 : jasper (ELSA-2017-1208)	Nessus	Oracle Linux Local Security Checks	2017/5/10	2025/12/19	high
100174	CentOS 6 / 7 : jasper (CESA-2017:1208)	Nessus	CentOS Local Security Checks	2017/5/16	2025/12/18	high
101464	Virtuozzo 6 : jasper / jasper-devel / jasper-libs / jasper-utils (VZLSA-2017-1208)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	high
94601	openSUSE Security Update : jasper (openSUSE-2016-1270)	Nessus	SuSE Local Security Checks	2016/11/7	2026/1/20	high
94728	SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2016:2775-1)	Nessus	SuSE Local Security Checks	2016/11/11	2026/1/19	high
94945	openSUSE Security Update : jasper (openSUSE-2016-1309)	Nessus	SuSE Local Security Checks	2016/11/18	2026/1/16	high
89660	Ubuntu 14.04 LTS : JasPer vulnerabilities (USN-2919-1)	Nessus	Ubuntu Local Security Checks	2016/3/4	2024/8/27	high
89698	Debian DSA-3508-1 : jasper - security update	Nessus	Debian Local Security Checks	2016/3/7	2021/1/11	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high