The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:1208 advisory.

    JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.

    Security Fix(es):

    Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could     cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2016-8654,     CVE-2016-9560, CVE-2016-10249, CVE-2015-5203, CVE-2015-5221, CVE-2016-1577, CVE-2016-8690, CVE-2016-8693,     CVE-2016-8884, CVE-2016-8885, CVE-2016-9262, CVE-2016-9591)

    Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could     cause an application using JasPer to crash. (CVE-2016-1867, CVE-2016-2089, CVE-2016-2116, CVE-2016-8691,     CVE-2016-8692, CVE-2016-8883, CVE-2016-9387, CVE-2016-9388, CVE-2016-9389, CVE-2016-9390, CVE-2016-9391,     CVE-2016-9392, CVE-2016-9393, CVE-2016-9394, CVE-2016-9583, CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)

    Red Hat would like to thank Liu Bingchang (IIE) for reporting CVE-2016-8654, CVE-2016-9583, CVE-2016-9591,     and CVE-2016-9600; Gustavo Grieco for reporting CVE-2015-5203; and Josselin Feist for reporting     CVE-2015-5221.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A

specially crafted file could cause an application using JasPer to crash or,

possibly, execute arbitrary code. ( CVE-2016-8654 , CVE-2016-9560 , CVE-2016-10249 ,

CVE-2015-5203 , CVE-2015-5221 , CVE-2016-1577 , CVE-2016-8690 , CVE-2016-8693 ,

CVE-2016-8884 , CVE-2016-8885 , CVE-2016-9262 , CVE-2016-9591 )

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A

specially crafted file could cause an application using JasPer to crash.

(CVE-2016-1867 , CVE-2016-2089 , CVE-2016-2116 , CVE-2016-8691 , CVE-2016-8692 ,

CVE-2016-8883 , CVE-2016-9387 , CVE-2016-9388 , CVE-2016-9389 , CVE-2016-9390 ,

CVE-2016-9391 , CVE-2016-9392 , CVE-2016-9393 , CVE-2016-9394 , CVE-2016-9583 ,

CVE-2016-9600 , CVE-2016-10248 , CVE-2016-10251)

According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Multiple flaws were found in the way JasPer decoded     JPEG 2000 image files. A specially crafted file could     cause an application using JasPer to crash or,     possibly, execute arbitrary code. (CVE-2016-8654,     CVE-2016-9560, CVE-2016-10249, CVE-2015-5203,     CVE-2015-5221, CVE-2016-1577, CVE-2016-8690,     CVE-2016-8693, CVE-2016-8884, CVE-2016-8885,     CVE-2016-9262, CVE-2016-9591)

  - Multiple flaws were found in the way JasPer decoded     JPEG 2000 image files. A specially crafted file could     cause an application using JasPer to crash.
    (CVE-2016-1867, CVE-2016-2089, CVE-2016-2116,     CVE-2016-8691, CVE-2016-8692, CVE-2016-8883,     CVE-2016-9387, CVE-2016-9388, CVE-2016-9389,     CVE-2016-9390, CVE-2016-9391, CVE-2016-9392,     CVE-2016-9393, CVE-2016-9394, CVE-2016-9583,     CVE-2016-9600, CVE-2016-10248, CVE-2016-10251)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Bump release

  - Multiple security fixes (fixed by thoger): CVE-2015-5203     CVE-2015-5221 CVE-2016-1577 CVE-2016-1867     (CVE-2016-2089) CVE-2016-2116 CVE-2016-8654     CVE-2016-8690 CVE-2016-8691 (CVE-2016-8692)     CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885     (CVE-2016-9262) CVE-2016-9387 CVE-2016-9388     CVE-2016-9389 CVE-2016-9390 (CVE-2016-9391)     CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560     (CVE-2016-9583) CVE-2016-9591 CVE-2016-9600     CVE-2016-10248 CVE-2016-10249 (CVE-2016-10251)

  - Fix implicit declaration warning caused by security     fixes above

  - CVE-2014-8157 - dec->numtiles off-by-one check in     jpc_dec_process_sot (#1183672)

  - CVE-2014-8158 - unrestricted stack memory use in     jpc_qmfb.c (#1183680)

  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy     (#1173567)

  - CVE-2014-8138 - heap overflow in jp2_decode (#1173567)

  - CVE-2014-9029 - incorrect component number check in COC,     RGN and QCC marker segment decoders (#1171209)

CVE-2016-8691 FPE on unknown address ... jpc_dec_process_siz ...
jpc_dec.c

CVE-2016-8692 FPE on unknown address ... jpc_dec_process_siz ...
jpc_dec.c

CVE-2016-8693 attempting double-free ... mem_close ... jas_stream.c

CVE-2016-8882 segfault / NULL pointer access in jpc_pi_destroy

CVE-2016-9560 stack-based buffer overflow in jpc_tsfb_getbands2 (jpc_tsfb.c)

CVE-2016-8887 part 1 + 2 NULL pointer dereference in jp2_colr_destroy (jp2_cod.c)

CVE-2016-8654 Heap-based buffer overflow in QMFB code in JPC codec

CVE-2016-8883 assert in jpc_dec_tiledecode()

TEMP-CVE heap-based buffer overflow in jpc_dec_tiledecode (jpc_dec.c)

For Debian 7 'Wheezy', these problems have been fixed in version 1.900.1-13+deb7u5.

We recommend that you upgrade your jasper packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3295-1 advisory.

    It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user or     automated system using JasPer were tricked into opening a specially crafted image, an attacker could     exploit this to cause a denial of service or possibly execute code with the privileges of the user     invoking the program.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for jasper fixes the following issues: Security issues fixed :

  - CVE-2016-8654: Heap-based buffer overflow in QMFB code     in JPC codec (bsc#1012530)

  - CVE-2016-9395: Missing sanity checks on the data in a     SIZ marker segment (bsc#1010977).

  - CVE-2016-9398: jpc_math.c:94: int jpc_floorlog2(int):
    Assertion 'x > 0' failed. (bsc#1010979)

  - CVE-2016-9560: stack-based buffer overflow in     jpc_tsfb_getbands2 (jpc_tsfb.c) (bsc#1011830)

  - CVE-2016-9583: Out of bounds heap read in     jpc_pi_nextpcrl() (bsc#1015400)

  - CVE-2016-9591: Use-after-free on heap in     jas_matrix_destroy (bsc#1015993)

  - CVE-2016-9600: NULL pointer Dereference due to missing     check for UNKNOWN color space in JP2 encoder     (bsc#1018088)

  - CVE-2016-10251: Use of uninitialized value in     jpc_pi_nextcprl (jpc_t2cod.c) (bsc#1029497)

  - CVE-2017-5498: left-shift undefined behaviour     (bsc#1020353)

  - CVE-2017-6850: NULL pointer dereference in     jp2_cdef_destroy (jp2_cod.c) (bsc#1021868)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues :

  - CVE-2016-8654: Heap-based buffer overflow in QMFB code     in JPC codec. (bsc#1012530)

  - CVE-2016-9395: Invalid jasper files could lead to abort     of the library caused by attacker provided image.
    (bsc#1010977)

  - CVE-2016-9398: Invalid jasper files could lead to abort     of the library caused by attacker provided image.
    (bsc#1010979)

  - CVE-2016-9560: Stack-based buffer overflow in     jpc_tsfb_getbands2. (bsc#1011830)

  - CVE-2016-9591: Use-after-free on heap in     jas_matrix_destroy. (bsc#1015993)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues :

  - CVE-2016-8654: Heap-based buffer overflow in QMFB code     in JPC codec. (bsc#1012530)

  - CVE-2016-9395: Invalid jasper files could lead to abort     of the library caused by attacker provided image.
    (bsc#1010977)

  - CVE-2016-9398: Invalid jasper files could lead to abort     of the library caused by attacker provided image.
    (bsc#1010979)

  - CVE-2016-9560: Stack-based buffer overflow in     jpc_tsfb_getbands2. (bsc#1011830)

  - CVE-2016-9591: Use-after-free on heap in     jas_matrix_destroy. (bsc#1015993)

This update was imported from the SUSE:SLE-12:Update update project.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1632 advisory.

    This advisory aggregates security fixes for the jasper SRPM in CIQ LTS 9.6. It addresses 37 CVEs:
    CVE-2008-3522, CVE-2016-1577, CVE-2014-9029, CVE-2016-9394, CVE-2021-3443, and 32 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
100093	RHEL 6 / 7 : jasper (RHSA-2017:1208)	Nessus	Red Hat Local Security Checks	2017/5/10	2025/12/19	high
100637	Amazon Linux AMI : jasper (ALAS-2017-836)	Nessus	Amazon Linux Local Security Checks	2017/6/7	2025/12/17	high
100811	EulerOS 2.0 SP1 : jasper (EulerOS-SA-2017-1094)	Nessus	Huawei Local Security Checks	2017/6/16	2025/12/16	high
100116	OracleVM 3.3 / 3.4 : jasper (OVMSA-2017-0102)	Nessus	OracleVM Local Security Checks	2017/5/11	2025/12/19	high
95664	Debian DLA-739-1 : jasper security updat	Nessus	Debian Local Security Checks	2016/12/12	2026/1/14	high
100294	Ubuntu 14.04 LTS / 16.04 LTS : JasPer vulnerabilities (USN-3295-1)	Nessus	Ubuntu Local Security Checks	2017/5/19	2024/8/27	high
99232	SUSE SLES11 Security Update : jasper (SUSE-SU-2017:0946-1)	Nessus	SuSE Local Security Checks	2017/4/6	2025/12/26	high
96387	SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2017:0084-1)	Nessus	SuSE Local Security Checks	2017/1/10	2026/1/6	high
96400	openSUSE Security Update : jasper (openSUSE-2017-70)	Nessus	SuSE Local Security Checks	2017/1/11	2026/1/6	high
364606	Rocky Linux 9.6 [CIQ] Security Update: jasper / jasper-devel / jasper-libs / jasper-utils Multiple Vulnerabilities (ciqsa-2026_1632)	Nessus	Rocky Linux Local Security Checks	2026/10/12	2026/10/13	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high