This package contains an implementation of the image compression standard JPEG-2000, Part 1. It consists of tools for conversion to and from the JP2 and JPC formats.
{"openvas": [{"lastseen": "2017-07-24T12:56:31", "description": "The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:144.", "cvss3": {}, "published": "2009-07-06T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:144 (ghostscript)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2017-07-06T00:00:00", "id": "OPENVAS:64341", "href": "http://plugins.openvas.org/nasl.php?oid=64341", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_144.nasl 6573 2017-07-06 13:10:50Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:144 (ghostscript)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin ghostscript:\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nPreviousely the ghostscript packages were statically built against\na bundled and private copy of the jasper library. This update makes\nghostscript link against the shared system jasper library which\nmakes it easier to address presumptive future security issues in the\njasper library.\n\nAffected: 2008.1, 2009.0, 2009.1\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:144\";\ntag_summary = \"The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:144.\";\n\n \n\nif(description)\n{\n script_id(64341);\n script_version(\"$Revision: 6573 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:10:50 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-06 20:36:15 +0200 (Mon, 06 Jul 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:144 (ghostscript)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"ghostscript\", rpm:\"ghostscript~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-common\", rpm:\"ghostscript-common~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-doc\", rpm:\"ghostscript-doc~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-dvipdf\", rpm:\"ghostscript-dvipdf~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-module-X\", rpm:\"ghostscript-module-X~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-X\", rpm:\"ghostscript-X~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8\", rpm:\"libgs8~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8-devel\", rpm:\"libgs8-devel~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1\", rpm:\"libijs1~0.35~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1-devel\", rpm:\"libijs1-devel~0.35~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8\", rpm:\"lib64gs8~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8-devel\", rpm:\"lib64gs8-devel~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1\", rpm:\"lib64ijs1~0.35~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1-devel\", rpm:\"lib64ijs1-devel~0.35~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript\", rpm:\"ghostscript~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-common\", rpm:\"ghostscript-common~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-doc\", rpm:\"ghostscript-doc~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-dvipdf\", rpm:\"ghostscript-dvipdf~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-module-X\", rpm:\"ghostscript-module-X~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-X\", rpm:\"ghostscript-X~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8\", rpm:\"libgs8~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8-devel\", rpm:\"libgs8-devel~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1\", rpm:\"libijs1~0.35~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1-devel\", rpm:\"libijs1-devel~0.35~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8\", rpm:\"lib64gs8~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8-devel\", rpm:\"lib64gs8-devel~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1\", rpm:\"lib64ijs1~0.35~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1-devel\", rpm:\"lib64ijs1-devel~0.35~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript\", rpm:\"ghostscript~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-common\", rpm:\"ghostscript-common~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-doc\", rpm:\"ghostscript-doc~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-dvipdf\", rpm:\"ghostscript-dvipdf~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-module-X\", rpm:\"ghostscript-module-X~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-X\", rpm:\"ghostscript-X~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8\", rpm:\"libgs8~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8-devel\", rpm:\"libgs8-devel~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1\", rpm:\"libijs1~0.35~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1-devel\", rpm:\"libijs1-devel~0.35~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8\", rpm:\"lib64gs8~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8-devel\", rpm:\"lib64gs8-devel~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1\", rpm:\"lib64ijs1~0.35~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1-devel\", rpm:\"lib64ijs1-devel~0.35~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:38:32", "description": "The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:144.", "cvss3": {}, "published": "2009-07-06T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:144 (ghostscript)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231064341", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064341", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_144.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:144 (ghostscript)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin ghostscript:\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nPreviousely the ghostscript packages were statically built against\na bundled and private copy of the jasper library. This update makes\nghostscript link against the shared system jasper library which\nmakes it easier to address presumptive future security issues in the\njasper library.\n\nAffected: 2008.1, 2009.0, 2009.1\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:144\";\ntag_summary = \"The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:144.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64341\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-06 20:36:15 +0200 (Mon, 06 Jul 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:144 (ghostscript)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"ghostscript\", rpm:\"ghostscript~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-common\", rpm:\"ghostscript-common~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-doc\", rpm:\"ghostscript-doc~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-dvipdf\", rpm:\"ghostscript-dvipdf~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-module-X\", rpm:\"ghostscript-module-X~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-X\", rpm:\"ghostscript-X~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8\", rpm:\"libgs8~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8-devel\", rpm:\"libgs8-devel~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1\", rpm:\"libijs1~0.35~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1-devel\", rpm:\"libijs1-devel~0.35~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8\", rpm:\"lib64gs8~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8-devel\", rpm:\"lib64gs8-devel~8.61~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1\", rpm:\"lib64ijs1~0.35~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1-devel\", rpm:\"lib64ijs1-devel~0.35~60.2mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript\", rpm:\"ghostscript~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-common\", rpm:\"ghostscript-common~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-doc\", rpm:\"ghostscript-doc~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-dvipdf\", rpm:\"ghostscript-dvipdf~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-module-X\", rpm:\"ghostscript-module-X~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-X\", rpm:\"ghostscript-X~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8\", rpm:\"libgs8~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8-devel\", rpm:\"libgs8-devel~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1\", rpm:\"libijs1~0.35~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1-devel\", rpm:\"libijs1-devel~0.35~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8\", rpm:\"lib64gs8~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8-devel\", rpm:\"lib64gs8-devel~8.63~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1\", rpm:\"lib64ijs1~0.35~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1-devel\", rpm:\"lib64ijs1-devel~0.35~62.2mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript\", rpm:\"ghostscript~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-common\", rpm:\"ghostscript-common~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-doc\", rpm:\"ghostscript-doc~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-dvipdf\", rpm:\"ghostscript-dvipdf~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-module-X\", rpm:\"ghostscript-module-X~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-X\", rpm:\"ghostscript-X~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8\", rpm:\"libgs8~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8-devel\", rpm:\"libgs8-devel~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1\", rpm:\"libijs1~0.35~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1-devel\", rpm:\"libijs1-devel~0.35~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8\", rpm:\"lib64gs8~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8-devel\", rpm:\"lib64gs8-devel~8.64~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1\", rpm:\"lib64ijs1~0.35~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1-devel\", rpm:\"lib64ijs1-devel~0.35~65.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-25T10:57:04", "description": "The remote host is missing an update to jasper\nannounced via advisory FEDORA-2009-10761.", "cvss3": {}, "published": "2009-11-11T00:00:00", "type": "openvas", "title": "Fedora Core 11 FEDORA-2009-10761 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:66132", "href": "http://plugins.openvas.org/nasl.php?oid=66132", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: fcore_2009_10761.nasl 6624 2017-07-10 06:11:55Z cfischer $\n# Description: Auto-generated from advisory FEDORA-2009-10761 (jasper)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"ChangeLog:\n\n* Tue Oct 13 2009 Rex Dieter - 1.900.1-13\n- CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)\n- CVE-2008-3522 jasper: possible buffer overflow in\n jas_stream_printf() (#461478)\";\ntag_solution = \"Apply the appropriate updates.\n\nThis update can be installed with the yum update program. Use \nsu -c 'yum update jasper' at the command line.\nFor more information, refer to Managing Software with yum,\navailable at http://docs.fedoraproject.org/yum/.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-10761\";\ntag_summary = \"The remote host is missing an update to jasper\nannounced via advisory FEDORA-2009-10761.\";\n\n\n\nif(description)\n{\n script_id(66132);\n script_version(\"$Revision: 6624 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:11:55 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-11-11 15:56:44 +0100 (Wed, 11 Nov 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Core 11 FEDORA-2009-10761 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=461476\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=461478\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~13.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-devel\", rpm:\"jasper-devel~1.900.1~13.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-libs\", rpm:\"jasper-libs~1.900.1~13.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-utils\", rpm:\"jasper-utils~1.900.1~13.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-debuginfo\", rpm:\"jasper-debuginfo~1.900.1~13.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:49:53", "description": "The remote host is missing updates announced in\nadvisory GLSA 200812-18.", "cvss3": {}, "published": "2008-12-23T00:00:00", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200812-18 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:62967", "href": "http://plugins.openvas.org/nasl.php?oid=62967", "sourceData": "#\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple memory management errors in JasPer might lead to execution of\narbitrary code via jpeg2k files.\";\ntag_solution = \"All JasPer users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=media-libs/jasper-1.900.1-r3'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200812-18\nhttp://bugs.gentoo.org/show_bug.cgi?id=222819\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200812-18.\";\n\n \n \n\nif(description)\n{\n script_id(62967);\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-12-23 18:28:16 +0100 (Tue, 23 Dec 2008)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Gentoo Security Advisory GLSA 200812-18 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"media-libs/jasper\", unaffected: make_list(\"ge 1.900.1-r3\"), vulnerable: make_list(\"lt 1.900.1-r3\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:56:18", "description": "The remote host is missing an update to netpbm\nannounced via advisory MDVSA-2009:143.", "cvss3": {}, "published": "2009-07-06T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:143 (netpbm)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:64338", "href": "http://plugins.openvas.org/nasl.php?oid=64338", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_143.nasl 6587 2017-07-07 06:35:35Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:143 (netpbm)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin netpbm:\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nThe updated packages have been patched to prevent this.\n\nAffected: Corporate 4.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:143\";\ntag_summary = \"The remote host is missing an update to netpbm\nannounced via advisory MDVSA-2009:143.\";\n\n \n\nif(description)\n{\n script_id(64338);\n script_version(\"$Revision: 6587 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 08:35:35 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-06 20:36:15 +0200 (Mon, 06 Jul 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:143 (netpbm)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"libnetpbm10\", rpm:\"libnetpbm10~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libnetpbm10-devel\", rpm:\"libnetpbm10-devel~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libnetpbm10-static-devel\", rpm:\"libnetpbm10-static-devel~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm10\", rpm:\"lib64netpbm10~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm10-devel\", rpm:\"lib64netpbm10-devel~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm10-static-devel\", rpm:\"lib64netpbm10-static-devel~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:56:13", "description": "The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:165.", "cvss3": {}, "published": "2009-08-17T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:165 (ghostscript)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:64498", "href": "http://plugins.openvas.org/nasl.php?oid=64498", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_165.nasl 6587 2017-07-07 06:35:35Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:165 (ghostscript)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin ghostscript:\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nPreviousely the ghostscript packages were statically built against\na bundled and private copy of the jasper library. This update makes\nghostscript link against the shared system jasper library which\nmakes it easier to address presumptive future security issues in the\njasper library.\n\nAffected: Enterprise Server 5.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:165\";\ntag_summary = \"The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:165.\";\n\n \n\nif(description)\n{\n script_id(64498);\n script_version(\"$Revision: 6587 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 08:35:35 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-08-17 16:54:45 +0200 (Mon, 17 Aug 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:165 (ghostscript)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"ghostscript\", rpm:\"ghostscript~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-common\", rpm:\"ghostscript-common~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-doc\", rpm:\"ghostscript-doc~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-dvipdf\", rpm:\"ghostscript-dvipdf~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-module-X\", rpm:\"ghostscript-module-X~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-X\", rpm:\"ghostscript-X~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8\", rpm:\"libgs8~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8-devel\", rpm:\"libgs8-devel~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1\", rpm:\"libijs1~0.35~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1-devel\", rpm:\"libijs1-devel~0.35~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8\", rpm:\"lib64gs8~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8-devel\", rpm:\"lib64gs8-devel~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1\", rpm:\"lib64ijs1~0.35~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1-devel\", rpm:\"lib64ijs1-devel~0.35~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:37:59", "description": "The remote host is missing an update to netpbm\nannounced via advisory MDVSA-2009:143.", "cvss3": {}, "published": "2009-07-06T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:143 (netpbm)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231064338", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064338", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_143.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:143 (netpbm)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin netpbm:\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nThe updated packages have been patched to prevent this.\n\nAffected: Corporate 4.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:143\";\ntag_summary = \"The remote host is missing an update to netpbm\nannounced via advisory MDVSA-2009:143.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64338\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-06 20:36:15 +0200 (Mon, 06 Jul 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:143 (netpbm)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"libnetpbm10\", rpm:\"libnetpbm10~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libnetpbm10-devel\", rpm:\"libnetpbm10-devel~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libnetpbm10-static-devel\", rpm:\"libnetpbm10-static-devel~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm10\", rpm:\"lib64netpbm10~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm10-devel\", rpm:\"lib64netpbm10-devel~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm10-static-devel\", rpm:\"lib64netpbm10-static-devel~10.29~1.5.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-25T10:56:41", "description": "The remote host is missing an update to jasper\nannounced via advisory FEDORA-2009-10737.", "cvss3": {}, "published": "2009-11-11T00:00:00", "type": "openvas", "title": "Fedora Core 10 FEDORA-2009-10737 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:66129", "href": "http://plugins.openvas.org/nasl.php?oid=66129", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: fcore_2009_10737.nasl 6624 2017-07-10 06:11:55Z cfischer $\n# Description: Auto-generated from advisory FEDORA-2009-10737 (jasper)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"ChangeLog:\n\n* Tue Oct 13 2009 Rex Dieter - 1.900.1-13\n- CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)\n- CVE-2008-3522 jasper: possible buffer overflow in\n jas_stream_printf() (#461478)\";\ntag_solution = \"Apply the appropriate updates.\n\nThis update can be installed with the yum update program. Use \nsu -c 'yum update jasper' at the command line.\nFor more information, refer to Managing Software with yum,\navailable at http://docs.fedoraproject.org/yum/.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-10737\";\ntag_summary = \"The remote host is missing an update to jasper\nannounced via advisory FEDORA-2009-10737.\";\n\n\n\nif(description)\n{\n script_id(66129);\n script_version(\"$Revision: 6624 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:11:55 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-11-11 15:56:44 +0100 (Wed, 11 Nov 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Core 10 FEDORA-2009-10737 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=461476\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=461478\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~13.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-devel\", rpm:\"jasper-devel~1.900.1~13.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-libs\", rpm:\"jasper-libs~1.900.1~13.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-utils\", rpm:\"jasper-utils~1.900.1~13.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-debuginfo\", rpm:\"jasper-debuginfo~1.900.1~13.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:39:05", "description": "The remote host is missing an update to jasper\nannounced via advisory FEDORA-2009-10737.", "cvss3": {}, "published": "2009-11-11T00:00:00", "type": "openvas", "title": "Fedora Core 10 FEDORA-2009-10737 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231066129", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231066129", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: fcore_2009_10737.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory FEDORA-2009-10737 (jasper)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"ChangeLog:\n\n* Tue Oct 13 2009 Rex Dieter - 1.900.1-13\n- CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)\n- CVE-2008-3522 jasper: possible buffer overflow in\n jas_stream_printf() (#461478)\";\ntag_solution = \"Apply the appropriate updates.\n\nThis update can be installed with the yum update program. Use \nsu -c 'yum update jasper' at the command line.\nFor more information, refer to Managing Software with yum,\navailable at http://docs.fedoraproject.org/yum/.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-10737\";\ntag_summary = \"The remote host is missing an update to jasper\nannounced via advisory FEDORA-2009-10737.\";\n\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.66129\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-11-11 15:56:44 +0100 (Wed, 11 Nov 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Core 10 FEDORA-2009-10737 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=461476\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=461478\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~13.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-devel\", rpm:\"jasper-devel~1.900.1~13.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-libs\", rpm:\"jasper-libs~1.900.1~13.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-utils\", rpm:\"jasper-utils~1.900.1~13.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-debuginfo\", rpm:\"jasper-debuginfo~1.900.1~13.fc10\", rls:\"FC10\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:40:10", "description": "The remote host is missing an update to jasper\nannounced via advisory FEDORA-2009-10761.", "cvss3": {}, "published": "2009-11-11T00:00:00", "type": "openvas", "title": "Fedora Core 11 FEDORA-2009-10761 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231066132", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231066132", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: fcore_2009_10761.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory FEDORA-2009-10761 (jasper)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"ChangeLog:\n\n* Tue Oct 13 2009 Rex Dieter - 1.900.1-13\n- CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)\n- CVE-2008-3522 jasper: possible buffer overflow in\n jas_stream_printf() (#461478)\";\ntag_solution = \"Apply the appropriate updates.\n\nThis update can be installed with the yum update program. Use \nsu -c 'yum update jasper' at the command line.\nFor more information, refer to Managing Software with yum,\navailable at http://docs.fedoraproject.org/yum/.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-10761\";\ntag_summary = \"The remote host is missing an update to jasper\nannounced via advisory FEDORA-2009-10761.\";\n\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.66132\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-11-11 15:56:44 +0100 (Wed, 11 Nov 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Fedora Core 11 FEDORA-2009-10761 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=461476\");\n script_xref(name : \"URL\" , value : \"https://bugzilla.redhat.com/show_bug.cgi?id=461478\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~13.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-devel\", rpm:\"jasper-devel~1.900.1~13.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-libs\", rpm:\"jasper-libs~1.900.1~13.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-utils\", rpm:\"jasper-utils~1.900.1~13.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper-debuginfo\", rpm:\"jasper-debuginfo~1.900.1~13.fc11\", rls:\"FC11\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:37:46", "description": "The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:165.", "cvss3": {}, "published": "2009-08-17T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:165 (ghostscript)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231064498", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064498", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_165.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:165 (ghostscript)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin ghostscript:\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nPreviousely the ghostscript packages were statically built against\na bundled and private copy of the jasper library. This update makes\nghostscript link against the shared system jasper library which\nmakes it easier to address presumptive future security issues in the\njasper library.\n\nAffected: Enterprise Server 5.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:165\";\ntag_summary = \"The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:165.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64498\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-08-17 16:54:45 +0200 (Mon, 17 Aug 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:165 (ghostscript)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"ghostscript\", rpm:\"ghostscript~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-common\", rpm:\"ghostscript-common~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-doc\", rpm:\"ghostscript-doc~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-dvipdf\", rpm:\"ghostscript-dvipdf~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-module-X\", rpm:\"ghostscript-module-X~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-X\", rpm:\"ghostscript-X~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8\", rpm:\"libgs8~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8-devel\", rpm:\"libgs8-devel~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1\", rpm:\"libijs1~0.35~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1-devel\", rpm:\"libijs1-devel~0.35~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8\", rpm:\"lib64gs8~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8-devel\", rpm:\"lib64gs8-devel~8.63~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1\", rpm:\"lib64ijs1~0.35~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1-devel\", rpm:\"lib64ijs1-devel~0.35~62.3mdvmes5\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:38:15", "description": "The remote host is missing an update to netpbm\nannounced via advisory MDVSA-2009:317.", "cvss3": {}, "published": "2009-12-10T00:00:00", "type": "openvas", "title": "Mandriva Security Advisory MDVSA-2009:317 (netpbm)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-4799", "CVE-2008-3520"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231066411", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231066411", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_317.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:317 (netpbm)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin netpbm:\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\npamperspective in Netpbm before 10.35.48 does not properly calculate\na window height, which allows context-dependent attackers to cause a\ndenial of service (crash) via a crafted image file that triggers an\nout-of-bounds read (CVE-2008-4799).\n\nPackages for 2008.0 are being provided due to extended support for\nCorporate products.\n\nThis update fixes this vulnerability.\n\nAffected: 2008.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:317\";\ntag_summary = \"The remote host is missing an update to netpbm\nannounced via advisory MDVSA-2009:317.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.66411\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-12-10 00:23:54 +0100 (Thu, 10 Dec 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\", \"CVE-2008-4799\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandriva Security Advisory MDVSA-2009:317 (netpbm)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"libnetpbm10\", rpm:\"libnetpbm10~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libnetpbm-devel\", rpm:\"libnetpbm-devel~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libnetpbm-static-devel\", rpm:\"libnetpbm-static-devel~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm10\", rpm:\"lib64netpbm10~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm-devel\", rpm:\"lib64netpbm-devel~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm-static-devel\", rpm:\"lib64netpbm-static-devel~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:38:54", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n jasper\n libjasper\n\n\nMore details may also be found by searching for the SuSE\nEnterprise Server 10 patch database located at\nhttp://download.novell.com/patch/finder/", "cvss3": {}, "published": "2009-10-13T00:00:00", "type": "openvas", "title": "SLES10: Security update for jasper", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231065824", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231065824", "sourceData": "#\n#VID slesp2-jasper-5782\n# OpenVAS Vulnerability Test\n# $\n# Description: Security update for jasper\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n jasper\n libjasper\n\n\nMore details may also be found by searching for the SuSE\nEnterprise Server 10 patch database located at\nhttp://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.65824\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-13 18:25:40 +0200 (Tue, 13 Oct 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"SLES10: Security update for jasper\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.701.0~16.10\", rls:\"SLES10.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper\", rpm:\"libjasper~1.701.0~16.10\", rls:\"SLES10.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-26T08:55:15", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n jasper\n libjasper\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5038720 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "cvss3": {}, "published": "2009-10-10T00:00:00", "type": "openvas", "title": "SLES9: Security update for jasper", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2017-07-11T00:00:00", "id": "OPENVAS:65039", "href": "http://plugins.openvas.org/nasl.php?oid=65039", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: sles9p5038720.nasl 6666 2017-07-11 13:13:36Z cfischer $\n# Description: Security update for jasper\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n jasper\n libjasper\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5038720 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n \nif(description)\n{\n script_id(65039);\n script_version(\"$Revision: 6666 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-11 15:13:36 +0200 (Tue, 11 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-10 16:11:46 +0200 (Sat, 10 Oct 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"SLES9: Security update for jasper\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.701.0~1.10\", rls:\"SLES9.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-26T08:55:46", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n jasper\n libjasper\n\n\nMore details may also be found by searching for the SuSE\nEnterprise Server 10 patch database located at\nhttp://download.novell.com/patch/finder/", "cvss3": {}, "published": "2009-10-13T00:00:00", "type": "openvas", "title": "SLES10: Security update for jasper", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2017-07-11T00:00:00", "id": "OPENVAS:65824", "href": "http://plugins.openvas.org/nasl.php?oid=65824", "sourceData": "#\n#VID slesp2-jasper-5782\n# OpenVAS Vulnerability Test\n# $\n# Description: Security update for jasper\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n jasper\n libjasper\n\n\nMore details may also be found by searching for the SuSE\nEnterprise Server 10 patch database located at\nhttp://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n\nif(description)\n{\n script_id(65824);\n script_version(\"$Revision: 6666 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-11 15:13:36 +0200 (Tue, 11 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-13 18:25:40 +0200 (Tue, 13 Oct 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"SLES10: Security update for jasper\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.701.0~16.10\", rls:\"SLES10.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper\", rpm:\"libjasper~1.701.0~16.10\", rls:\"SLES10.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:56:25", "description": "The remote host is missing an update to netpbm\nannounced via advisory MDVSA-2009:317.", "cvss3": {}, "published": "2009-12-10T00:00:00", "type": "openvas", "title": "Mandriva Security Advisory MDVSA-2009:317 (netpbm)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-4799", "CVE-2008-3520"], "modified": "2017-07-06T00:00:00", "id": "OPENVAS:66411", "href": "http://plugins.openvas.org/nasl.php?oid=66411", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_317.nasl 6573 2017-07-06 13:10:50Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:317 (netpbm)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin netpbm:\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\npamperspective in Netpbm before 10.35.48 does not properly calculate\na window height, which allows context-dependent attackers to cause a\ndenial of service (crash) via a crafted image file that triggers an\nout-of-bounds read (CVE-2008-4799).\n\nPackages for 2008.0 are being provided due to extended support for\nCorporate products.\n\nThis update fixes this vulnerability.\n\nAffected: 2008.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:317\";\ntag_summary = \"The remote host is missing an update to netpbm\nannounced via advisory MDVSA-2009:317.\";\n\n \n\nif(description)\n{\n script_id(66411);\n script_version(\"$Revision: 6573 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:10:50 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-12-10 00:23:54 +0100 (Thu, 10 Dec 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\", \"CVE-2008-4799\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandriva Security Advisory MDVSA-2009:317 (netpbm)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"libnetpbm10\", rpm:\"libnetpbm10~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libnetpbm-devel\", rpm:\"libnetpbm-devel~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libnetpbm-static-devel\", rpm:\"libnetpbm-static-devel~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm10\", rpm:\"lib64netpbm10~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm-devel\", rpm:\"lib64netpbm-devel~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64netpbm-static-devel\", rpm:\"lib64netpbm-static-devel~10.34~8.2mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:37:25", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n jasper\n libjasper\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5038720 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "cvss3": {}, "published": "2009-10-10T00:00:00", "type": "openvas", "title": "SLES9: Security update for jasper", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231065039", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231065039", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: sles9p5038720.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Security update for jasper\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n jasper\n libjasper\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5038720 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n \nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.65039\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-10 16:11:46 +0200 (Sat, 10 Oct 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"SLES9: Security update for jasper\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.701.0~1.10\", rls:\"SLES9.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:56:40", "description": "The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:142-1.", "cvss3": {}, "published": "2009-12-10T00:00:00", "type": "openvas", "title": "Mandriva Security Advisory MDVSA-2009:142-1 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2007-2721", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2017-07-06T00:00:00", "id": "OPENVAS:66379", "href": "http://plugins.openvas.org/nasl.php?oid=66379", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_142_1.nasl 6573 2017-07-06 13:10:50Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:142-1 (jasper)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin jasper:\n\nThe jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer\nJPEG-2000 library (libjasper) before 1.900 allows remote user-assisted\nattackers to cause a denial of service (crash) and possibly corrupt\nthe heap via malformed image files, as originally demonstrated using\nimagemagick convert (CVE-2007-2721).\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nThe jas_stream_tmpfile function in libjasper/base/jas_stream.c in\nJasPer 1.900.1 allows local users to overwrite arbitrary files via\na symlink attack on a tmp.XXXXXXXXXX temporary file (CVE-2008-3521).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nThe updated packages have been patched to prevent this.\n\nUpdate:\n\nPackages for 2008.0 are being provided due to extended support for\nCorporate products.\n\nAffected: 2008.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:142-1\";\ntag_summary = \"The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:142-1.\";\n\n \n\nif(description)\n{\n script_id(66379);\n script_version(\"$Revision: 6573 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:10:50 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-12-10 00:23:54 +0100 (Thu, 10 Dec 2009)\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandriva Security Advisory MDVSA-2009:142-1 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1\", rpm:\"libjasper1~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-devel\", rpm:\"libjasper1-devel~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-static-devel\", rpm:\"libjasper1-static-devel~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1\", rpm:\"lib64jasper1~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-devel\", rpm:\"lib64jasper1-devel~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-static-devel\", rpm:\"lib64jasper1-static-devel~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:56:40", "description": "The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:164.", "cvss3": {}, "published": "2009-08-17T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:164 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2007-2721", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:64497", "href": "http://plugins.openvas.org/nasl.php?oid=64497", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_164.nasl 6587 2017-07-07 06:35:35Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:164 (jasper)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin jasper:\n\nThe jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer\nJPEG-2000 library (libjasper) before 1.900 allows remote user-assisted\nattackers to cause a denial of service (crash) and possibly corrupt\nthe heap via malformed image files, as originally demonstrated using\nimagemagick convert (CVE-2007-2721).\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nThe jas_stream_tmpfile function in libjasper/base/jas_stream.c in\nJasPer 1.900.1 allows local users to overwrite arbitrary files via\na symlink attack on a tmp.XXXXXXXXXX temporary file (CVE-2008-3521).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nThe updated packages have been patched to prevent this.\n\nAffected: Enterprise Server 5.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:164\";\ntag_summary = \"The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:164.\";\n\n \n\nif(description)\n{\n script_id(64497);\n script_version(\"$Revision: 6587 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 08:35:35 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-08-17 16:54:45 +0200 (Mon, 17 Aug 2009)\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:164 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1\", rpm:\"libjasper1~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-devel\", rpm:\"libjasper1-devel~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-static-devel\", rpm:\"libjasper1-static-devel~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1\", rpm:\"lib64jasper1~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-devel\", rpm:\"lib64jasper1-devel~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-static-devel\", rpm:\"lib64jasper1-static-devel~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:57:06", "description": "The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:142.", "cvss3": {}, "published": "2009-07-06T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:142 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2007-2721", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2017-07-06T00:00:00", "id": "OPENVAS:64340", "href": "http://plugins.openvas.org/nasl.php?oid=64340", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_142.nasl 6573 2017-07-06 13:10:50Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:142 (jasper)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin jasper:\n\nThe jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer\nJPEG-2000 library (libjasper) before 1.900 allows remote user-assisted\nattackers to cause a denial of service (crash) and possibly corrupt\nthe heap via malformed image files, as originally demonstrated using\nimagemagick convert (CVE-2007-2721).\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nThe jas_stream_tmpfile function in libjasper/base/jas_stream.c in\nJasPer 1.900.1 allows local users to overwrite arbitrary files via\na symlink attack on a tmp.XXXXXXXXXX temporary file (CVE-2008-3521).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nThe updated packages have been patched to prevent this.\n\nAffected: 2008.1, 2009.0, 2009.1, Corporate 4.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:142\";\ntag_summary = \"The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:142.\";\n\n \n\nif(description)\n{\n script_id(64340);\n script_version(\"$Revision: 6573 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:10:50 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-06 20:36:15 +0200 (Mon, 06 Jul 2009)\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:142 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1\", rpm:\"libjasper1~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-devel\", rpm:\"libjasper1-devel~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-static-devel\", rpm:\"libjasper1-static-devel~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1\", rpm:\"lib64jasper1~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-devel\", rpm:\"lib64jasper1-devel~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-static-devel\", rpm:\"lib64jasper1-static-devel~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1\", rpm:\"libjasper1~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-devel\", rpm:\"libjasper1-devel~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-static-devel\", rpm:\"libjasper1-static-devel~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1\", rpm:\"lib64jasper1~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-devel\", rpm:\"lib64jasper1-devel~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-static-devel\", rpm:\"lib64jasper1-static-devel~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1\", rpm:\"libjasper1~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper-devel\", rpm:\"libjasper-devel~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper-static-devel\", rpm:\"libjasper-static-devel~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1\", rpm:\"lib64jasper1~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper-devel\", rpm:\"lib64jasper-devel~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper-static-devel\", rpm:\"lib64jasper-static-devel~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1.701_1\", rpm:\"libjasper1.701_1~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1.701_1-devel\", rpm:\"libjasper1.701_1-devel~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1.701_1-static-devel\", rpm:\"libjasper1.701_1-static-devel~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1.701_1\", rpm:\"lib64jasper1.701_1~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1.701_1-devel\", rpm:\"lib64jasper1.701_1-devel~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1.701_1-static-devel\", rpm:\"lib64jasper1.701_1-static-devel~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:38:58", "description": "The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:164.", "cvss3": {}, "published": "2009-08-17T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:164 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2007-2721", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231064497", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064497", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_164.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:164 (jasper)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin jasper:\n\nThe jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer\nJPEG-2000 library (libjasper) before 1.900 allows remote user-assisted\nattackers to cause a denial of service (crash) and possibly corrupt\nthe heap via malformed image files, as originally demonstrated using\nimagemagick convert (CVE-2007-2721).\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nThe jas_stream_tmpfile function in libjasper/base/jas_stream.c in\nJasPer 1.900.1 allows local users to overwrite arbitrary files via\na symlink attack on a tmp.XXXXXXXXXX temporary file (CVE-2008-3521).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nThe updated packages have been patched to prevent this.\n\nAffected: Enterprise Server 5.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:164\";\ntag_summary = \"The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:164.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64497\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-08-17 16:54:45 +0200 (Mon, 17 Aug 2009)\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:164 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1\", rpm:\"libjasper1~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-devel\", rpm:\"libjasper1-devel~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-static-devel\", rpm:\"libjasper1-static-devel~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1\", rpm:\"lib64jasper1~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-devel\", rpm:\"lib64jasper1-devel~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-static-devel\", rpm:\"lib64jasper1-static-devel~1.900.1~4.2mdvmes2009.0\", rls:\"MNDK_mes5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:40:16", "description": "The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:142.", "cvss3": {}, "published": "2009-07-06T00:00:00", "type": "openvas", "title": "Mandrake Security Advisory MDVSA-2009:142 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2007-2721", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231064340", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064340", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_142.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:142 (jasper)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin jasper:\n\nThe jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer\nJPEG-2000 library (libjasper) before 1.900 allows remote user-assisted\nattackers to cause a denial of service (crash) and possibly corrupt\nthe heap via malformed image files, as originally demonstrated using\nimagemagick convert (CVE-2007-2721).\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nThe jas_stream_tmpfile function in libjasper/base/jas_stream.c in\nJasPer 1.900.1 allows local users to overwrite arbitrary files via\na symlink attack on a tmp.XXXXXXXXXX temporary file (CVE-2008-3521).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nThe updated packages have been patched to prevent this.\n\nAffected: 2008.1, 2009.0, 2009.1, Corporate 4.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:142\";\ntag_summary = \"The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:142.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64340\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-07-06 20:36:15 +0200 (Mon, 06 Jul 2009)\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandrake Security Advisory MDVSA-2009:142 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1\", rpm:\"libjasper1~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-devel\", rpm:\"libjasper1-devel~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-static-devel\", rpm:\"libjasper1-static-devel~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1\", rpm:\"lib64jasper1~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-devel\", rpm:\"lib64jasper1-devel~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-static-devel\", rpm:\"lib64jasper1-static-devel~1.900.1~3.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1\", rpm:\"libjasper1~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-devel\", rpm:\"libjasper1-devel~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-static-devel\", rpm:\"libjasper1-static-devel~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1\", rpm:\"lib64jasper1~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-devel\", rpm:\"lib64jasper1-devel~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-static-devel\", rpm:\"lib64jasper1-static-devel~1.900.1~4.1mdv2009.0\", rls:\"MNDK_2009.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1\", rpm:\"libjasper1~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper-devel\", rpm:\"libjasper-devel~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper-static-devel\", rpm:\"libjasper-static-devel~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1\", rpm:\"lib64jasper1~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper-devel\", rpm:\"lib64jasper-devel~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper-static-devel\", rpm:\"lib64jasper-static-devel~1.900.1~5.1mdv2009.1\", rls:\"MNDK_2009.1\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1.701_1\", rpm:\"libjasper1.701_1~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1.701_1-devel\", rpm:\"libjasper1.701_1-devel~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1.701_1-static-devel\", rpm:\"libjasper1.701_1-static-devel~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1.701_1\", rpm:\"lib64jasper1.701_1~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1.701_1-devel\", rpm:\"lib64jasper1.701_1-devel~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1.701_1-static-devel\", rpm:\"lib64jasper1.701_1-static-devel~1.701.0~3.1.20060mlcs4\", rls:\"MNDK_4.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:38:57", "description": "The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:142-1.", "cvss3": {}, "published": "2009-12-10T00:00:00", "type": "openvas", "title": "Mandriva Security Advisory MDVSA-2009:142-1 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2007-2721", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231066379", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231066379", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_142_1.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:142-1 (jasper)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Multiple security vulnerabilities has been identified and fixed\nin jasper:\n\nThe jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer\nJPEG-2000 library (libjasper) before 1.900 allows remote user-assisted\nattackers to cause a denial of service (crash) and possibly corrupt\nthe heap via malformed image files, as originally demonstrated using\nimagemagick convert (CVE-2007-2721).\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nThe jas_stream_tmpfile function in libjasper/base/jas_stream.c in\nJasPer 1.900.1 allows local users to overwrite arbitrary files via\na symlink attack on a tmp.XXXXXXXXXX temporary file (CVE-2008-3521).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via\nvectors related to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nThe updated packages have been patched to prevent this.\n\nUpdate:\n\nPackages for 2008.0 are being provided due to extended support for\nCorporate products.\n\nAffected: 2008.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:142-1\";\ntag_summary = \"The remote host is missing an update to jasper\nannounced via advisory MDVSA-2009:142-1.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.66379\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-12-10 00:23:54 +0100 (Thu, 10 Dec 2009)\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandriva Security Advisory MDVSA-2009:142-1 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"jasper\", rpm:\"jasper~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1\", rpm:\"libjasper1~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-devel\", rpm:\"libjasper1-devel~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libjasper1-static-devel\", rpm:\"libjasper1-static-devel~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1\", rpm:\"lib64jasper1~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-devel\", rpm:\"lib64jasper1-devel~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64jasper1-static-devel\", rpm:\"lib64jasper1-static-devel~1.900.1~2.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:38:32", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-1317-1", "cvss3": {}, "published": "2012-01-09T00:00:00", "type": "openvas", "title": "Ubuntu Update for ghostscript USN-1317-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4516", "CVE-2008-3522", "CVE-2008-3520", "CVE-2009-3743", "CVE-2010-4054", "CVE-2011-4517"], "modified": "2019-03-13T00:00:00", "id": "OPENVAS:1361412562310840856", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310840856", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_1317_1.nasl 14132 2019-03-13 09:25:59Z cfischer $\n#\n# Ubuntu Update for ghostscript USN-1317-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-1317-1/\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.840856\");\n script_version(\"$Revision: 14132 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 10:25:59 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2012-01-09 13:29:45 +0530 (Mon, 09 Jan 2012)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name:\"USN\", value:\"1317-1\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\", \"CVE-2009-3743\", \"CVE-2010-4054\",\n \"CVE-2011-4516\", \"CVE-2011-4517\");\n script_name(\"Ubuntu Update for ghostscript USN-1317-1\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU(10\\.04 LTS|10\\.10|8\\.04 LTS)\");\n script_tag(name:\"summary\", value:\"Ubuntu Update for Linux kernel vulnerabilities USN-1317-1\");\n script_tag(name:\"affected\", value:\"ghostscript on Ubuntu 10.10,\n Ubuntu 10.04 LTS,\n Ubuntu 8.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n script_tag(name:\"insight\", value:\"It was discovered that Ghostscript did not correctly handle memory\n allocation when parsing certain malformed JPEG-2000 images. If a user or\n automated system were tricked into opening a specially crafted image, an\n attacker could cause a denial of service and possibly execute arbitrary\n code with user privileges. (CVE-2008-3520)\n\n It was discovered that Ghostscript did not correctly handle certain\n formatting operations when parsing JPEG-2000 images. If a user or automated\n system were tricked into opening a specially crafted image, an attacker\n could cause a denial of service and possibly execute arbitrary code with\n user privileges. (CVE-2008-3522)\n\n It was discovered that Ghostscript incorrectly handled certain malformed\n TrueType fonts. If a user or automated system were tricked into opening a\n document containing a specially crafted font, an attacker could cause a\n denial of service and possibly execute arbitrary code with user privileges.\n This issue only affected Ubuntu 8.04 LTS. (CVE-2009-3743)\n\n It was discovered that Ghostscript incorrectly handled certain malformed\n Type 2 fonts. If a user or automated system were tricked into opening a\n document containing a specially crafted font, an attacker could cause a\n denial of service and possibly execute arbitrary code with user privileges.\n This issue only affected Ubuntu 8.04 LTS. (CVE-2010-4054)\n\n Jonathan Foote discovered that Ghostscript incorrectly handled certain\n malformed JPEG-2000 image files. If a user or automated system were tricked\n into opening a specially crafted JPEG-2000 image file, an attacker could\n cause Ghostscript to crash or possibly execute arbitrary code with user\n privileges. (CVE-2011-4516, CVE-2011-4517)\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU10.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libgs8\", ver:\"8.71.dfsg.1-0ubuntu5.4\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU10.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libgs8\", ver:\"8.71.dfsg.2-0ubuntu7.1\", rls:\"UBUNTU10.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU8.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libgs8\", ver:\"8.61.dfsg.1-1ubuntu3.4\", rls:\"UBUNTU8.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-12-04T11:20:14", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-1317-1", "cvss3": {}, "published": "2012-01-09T00:00:00", "type": "openvas", "title": "Ubuntu Update for ghostscript USN-1317-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2011-4516", "CVE-2008-3522", "CVE-2008-3520", "CVE-2009-3743", "CVE-2010-4054", "CVE-2011-4517"], "modified": "2017-12-01T00:00:00", "id": "OPENVAS:840856", "href": "http://plugins.openvas.org/nasl.php?oid=840856", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_1317_1.nasl 7960 2017-12-01 06:58:16Z santu $\n#\n# Ubuntu Update for ghostscript USN-1317-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2012 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"It was discovered that Ghostscript did not correctly handle memory\n allocation when parsing certain malformed JPEG-2000 images. If a user or\n automated system were tricked into opening a specially crafted image, an\n attacker could cause a denial of service and possibly execute arbitrary\n code with user privileges. (CVE-2008-3520)\n\n It was discovered that Ghostscript did not correctly handle certain\n formatting operations when parsing JPEG-2000 images. If a user or automated\n system were tricked into opening a specially crafted image, an attacker\n could cause a denial of service and possibly execute arbitrary code with\n user privileges. (CVE-2008-3522)\n\n It was discovered that Ghostscript incorrectly handled certain malformed\n TrueType fonts. If a user or automated system were tricked into opening a\n document containing a specially crafted font, an attacker could cause a\n denial of service and possibly execute arbitrary code with user privileges.\n This issue only affected Ubuntu 8.04 LTS. (CVE-2009-3743)\n\n It was discovered that Ghostscript incorrectly handled certain malformed\n Type 2 fonts. If a user or automated system were tricked into opening a\n document containing a specially crafted font, an attacker could cause a\n denial of service and possibly execute arbitrary code with user privileges.\n This issue only affected Ubuntu 8.04 LTS. (CVE-2010-4054)\n\n Jonathan Foote discovered that Ghostscript incorrectly handled certain\n malformed JPEG-2000 image files. If a user or automated system were tricked\n into opening a specially crafted JPEG-2000 image file, an attacker could\n cause Ghostscript to crash or possibly execute arbitrary code with user\n privileges. (CVE-2011-4516, CVE-2011-4517)\";\n\ntag_summary = \"Ubuntu Update for Linux kernel vulnerabilities USN-1317-1\";\ntag_affected = \"ghostscript on Ubuntu 10.10 ,\n Ubuntu 10.04 LTS ,\n Ubuntu 8.04 LTS\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\nif(description)\n{\n script_xref(name: \"URL\" , value: \"http://www.ubuntu.com/usn/usn-1317-1/\");\n script_id(840856);\n script_version(\"$Revision: 7960 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-01 07:58:16 +0100 (Fri, 01 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2012-01-09 13:29:45 +0530 (Mon, 09 Jan 2012)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"USN\", value: \"1317-1\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\", \"CVE-2009-3743\", \"CVE-2010-4054\",\n \"CVE-2011-4516\", \"CVE-2011-4517\");\n script_name(\"Ubuntu Update for ghostscript USN-1317-1\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"UBUNTU10.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libgs8\", ver:\"8.71.dfsg.1-0ubuntu5.4\", rls:\"UBUNTU10.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU10.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libgs8\", ver:\"8.71.dfsg.2-0ubuntu7.1\", rls:\"UBUNTU10.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU8.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"libgs8\", ver:\"8.61.dfsg.1-1ubuntu3.4\", rls:\"UBUNTU8.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:40:25", "description": "The remote host is missing updates to netpbm announced in\nadvisory CESA-2009:0012.", "cvss3": {}, "published": "2009-02-13T00:00:00", "type": "openvas", "title": "CentOS Security Advisory CESA-2009:0012 (netpbm)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231063366", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231063366", "sourceData": "#CESA-2009:0012 63366 4\n# $Id: ovcesa2009_0012.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory CESA-2009:0012 (netpbm)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"For details on the issues addressed in this update,\nplease visit the referenced security advisories.\";\ntag_solution = \"Update the appropriate packages on your system.\n\nhttp://www.securityspace.com/smysecure/catid.html?in=CESA-2009:0012\nhttp://www.securityspace.com/smysecure/catid.html?in=RHSA-2009:0012\nhttps://rhn.redhat.com/errata/RHSA-2009-0012.html\";\ntag_summary = \"The remote host is missing updates to netpbm announced in\nadvisory CESA-2009:0012.\";\n\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.63366\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-02-13 20:43:17 +0100 (Fri, 13 Feb 2009)\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"CentOS Security Advisory CESA-2009:0012 (netpbm)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-devel\", rpm:\"netpbm-devel~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-progs\", rpm:\"netpbm-progs~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:36:13", "description": "Oracle Linux Local Security Checks ELSA-2009-0012", "cvss3": {}, "published": "2015-10-08T00:00:00", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2009-0012", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2018-09-28T00:00:00", "id": "OPENVAS:1361412562310122518", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310122518", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2009-0012.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.122518\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-08 14:47:09 +0300 (Thu, 08 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2009-0012\");\n script_tag(name:\"insight\", value:\"ELSA-2009-0012 - netpbm security update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2009-0012\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2009-0012.html\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux5\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux5\")\n{\n if ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.35~6.1.el5_3.1\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"netpbm-devel\", rpm:\"netpbm-devel~10.35~6.1.el5_3.1\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n if ((res = isrpmvuln(pkg:\"netpbm-progs\", rpm:\"netpbm-progs~10.35~6.1.el5_3.1\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-07-25T10:55:52", "description": "Check for the Version of netpbm", "cvss3": {}, "published": "2011-08-09T00:00:00", "type": "openvas", "title": "CentOS Update for netpbm CESA-2009:0012 centos4 i386", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:880774", "href": "http://plugins.openvas.org/nasl.php?oid=880774", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for netpbm CESA-2009:0012 centos4 i386\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The netpbm package contains a library of functions for editing and\n converting between various graphics file formats, including .pbm (portable\n bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable\n pixmaps), and others.\n\n An input validation flaw and multiple integer overflows were discovered in\n the JasPer library providing support for JPEG-2000 image format and used in\n the jpeg2ktopam and pamtojpeg2k converters. An attacker could create a\n carefully-crafted JPEG file which could cause jpeg2ktopam to crash or,\n possibly, execute arbitrary code as the user running jpeg2ktopam.\n (CVE-2007-2721, CVE-2008-3520)\n \n All users are advised to upgrade to these updated packages which contain\n backported patches which resolve these issues.\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"netpbm on CentOS 4\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.centos.org/pipermail/centos-announce/2009-February/015631.html\");\n script_id(880774);\n script_version(\"$Revision: 6653 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 13:46:53 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-09 08:20:34 +0200 (Tue, 09 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name: \"CESA\", value: \"2009:0012\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\");\n script_name(\"CentOS Update for netpbm CESA-2009:0012 centos4 i386\");\n\n script_summary(\"Check for the Version of netpbm\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS4\")\n{\n\n if ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"netpbm-devel\", rpm:\"netpbm-devel~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"netpbm-progs\", rpm:\"netpbm-progs~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-27T10:56:46", "description": "The remote host is missing updates announced in\nadvisory RHSA-2009:0012.\n\nThe netpbm package contains a library of functions for editing and\nconverting between various graphics file formats, including .pbm (portable\nbitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable\npixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were discovered in\nthe JasPer library providing support for JPEG-2000 image format and used in\nthe jpeg2ktopam and pamtojpeg2k converters. An attacker could create a\ncarefully-crafted JPEG file which could cause jpeg2ktopam to crash or,\npossibly, execute arbitrary code as the user running jpeg2ktopam.\n(CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which contain\nbackported patches which resolve these issues.", "cvss3": {}, "published": "2009-02-13T00:00:00", "type": "openvas", "title": "RedHat Security Advisory RHSA-2009:0012", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2017-07-12T00:00:00", "id": "OPENVAS:63368", "href": "http://plugins.openvas.org/nasl.php?oid=63368", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: RHSA_2009_0012.nasl 6683 2017-07-12 09:41:57Z cfischer $\n# Description: Auto-generated from advisory RHSA-2009:0012 ()\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates announced in\nadvisory RHSA-2009:0012.\n\nThe netpbm package contains a library of functions for editing and\nconverting between various graphics file formats, including .pbm (portable\nbitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable\npixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were discovered in\nthe JasPer library providing support for JPEG-2000 image format and used in\nthe jpeg2ktopam and pamtojpeg2k converters. An attacker could create a\ncarefully-crafted JPEG file which could cause jpeg2ktopam to crash or,\npossibly, execute arbitrary code as the user running jpeg2ktopam.\n(CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which contain\nbackported patches which resolve these issues.\";\n\ntag_solution = \"Please note that this update is available via\nRed Hat Network. To use Red Hat Network, launch the Red\nHat Update Agent with the following command: up2date\";\n\n\n\nif(description)\n{\n script_id(63368);\n script_version(\"$Revision: 6683 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-12 11:41:57 +0200 (Wed, 12 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-02-13 20:43:17 +0100 (Fri, 13 Feb 2009)\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"RedHat Security Advisory RHSA-2009:0012\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"http://rhn.redhat.com/errata/RHSA-2009-0012.html\");\n script_xref(name : \"URL\" , value : \"http://www.redhat.com/security/updates/classification/#moderate\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.25~2.1.el4_7.4\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-debuginfo\", rpm:\"netpbm-debuginfo~10.25~2.1.el4_7.4\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-devel\", rpm:\"netpbm-devel~10.25~2.1.el4_7.4\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-progs\", rpm:\"netpbm-progs~10.25~2.1.el4_7.4\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.35~6.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-debuginfo\", rpm:\"netpbm-debuginfo~10.35~6.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-progs\", rpm:\"netpbm-progs~10.35~6.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-devel\", rpm:\"netpbm-devel~10.35~6.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:40:29", "description": "The remote host is missing updates announced in\nadvisory RHSA-2009:0012.\n\nThe netpbm package contains a library of functions for editing and\nconverting between various graphics file formats, including .pbm (portable\nbitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable\npixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were discovered in\nthe JasPer library providing support for JPEG-2000 image format and used in\nthe jpeg2ktopam and pamtojpeg2k converters. An attacker could create a\ncarefully-crafted JPEG file which could cause jpeg2ktopam to crash or,\npossibly, execute arbitrary code as the user running jpeg2ktopam.\n(CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which contain\nbackported patches which resolve these issues.", "cvss3": {}, "published": "2009-02-13T00:00:00", "type": "openvas", "title": "RedHat Security Advisory RHSA-2009:0012", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231063368", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231063368", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: RHSA_2009_0012.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory RHSA-2009:0012 ()\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates announced in\nadvisory RHSA-2009:0012.\n\nThe netpbm package contains a library of functions for editing and\nconverting between various graphics file formats, including .pbm (portable\nbitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable\npixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were discovered in\nthe JasPer library providing support for JPEG-2000 image format and used in\nthe jpeg2ktopam and pamtojpeg2k converters. An attacker could create a\ncarefully-crafted JPEG file which could cause jpeg2ktopam to crash or,\npossibly, execute arbitrary code as the user running jpeg2ktopam.\n(CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which contain\nbackported patches which resolve these issues.\";\n\ntag_solution = \"Please note that this update is available via\nRed Hat Network. To use Red Hat Network, launch the Red\nHat Update Agent with the following command: up2date\";\n\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.63368\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-02-13 20:43:17 +0100 (Fri, 13 Feb 2009)\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"RedHat Security Advisory RHSA-2009:0012\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"http://rhn.redhat.com/errata/RHSA-2009-0012.html\");\n script_xref(name : \"URL\" , value : \"http://www.redhat.com/security/updates/classification/#moderate\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.25~2.1.el4_7.4\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-debuginfo\", rpm:\"netpbm-debuginfo~10.25~2.1.el4_7.4\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-devel\", rpm:\"netpbm-devel~10.25~2.1.el4_7.4\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-progs\", rpm:\"netpbm-progs~10.25~2.1.el4_7.4\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.35~6.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-debuginfo\", rpm:\"netpbm-debuginfo~10.35~6.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-progs\", rpm:\"netpbm-progs~10.35~6.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-devel\", rpm:\"netpbm-devel~10.35~6.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:39:35", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2011-08-09T00:00:00", "type": "openvas", "title": "CentOS Update for netpbm CESA-2009:0012 centos4 i386", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310880774", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310880774", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for netpbm CESA-2009:0012 centos4 i386\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2009-February/015631.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.880774\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-09 08:20:34 +0200 (Tue, 09 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_xref(name:\"CESA\", value:\"2009:0012\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\");\n script_name(\"CentOS Update for netpbm CESA-2009:0012 centos4 i386\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'netpbm'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS4\");\n script_tag(name:\"affected\", value:\"netpbm on CentOS 4\");\n script_tag(name:\"insight\", value:\"The netpbm package contains a library of functions for editing and\n converting between various graphics file formats, including .pbm (portable\n bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable\n pixmaps), and others.\n\n An input validation flaw and multiple integer overflows were discovered in\n the JasPer library providing support for JPEG-2000 image format and used in\n the jpeg2ktopam and pamtojpeg2k converters. An attacker could create a\n carefully-crafted JPEG file which could cause jpeg2ktopam to crash or,\n possibly, execute arbitrary code as the user running jpeg2ktopam.\n (CVE-2007-2721, CVE-2008-3520)\n\n All users are advised to upgrade to these updated packages which contain\n backported patches which resolve these issues.\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS4\")\n{\n\n if ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"netpbm-devel\", rpm:\"netpbm-devel~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"netpbm-progs\", rpm:\"netpbm-progs~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2017-07-25T10:57:09", "description": "The remote host is missing updates to netpbm announced in\nadvisory CESA-2009:0012.", "cvss3": {}, "published": "2009-02-13T00:00:00", "type": "openvas", "title": "CentOS Security Advisory CESA-2009:0012 (netpbm)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:63366", "href": "http://plugins.openvas.org/nasl.php?oid=63366", "sourceData": "#CESA-2009:0012 63366 4\n# $Id: ovcesa2009_0012.nasl 6650 2017-07-10 11:43:12Z cfischer $\n# Description: Auto-generated from advisory CESA-2009:0012 (netpbm)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"For details on the issues addressed in this update,\nplease visit the referenced security advisories.\";\ntag_solution = \"Update the appropriate packages on your system.\n\nhttp://www.securityspace.com/smysecure/catid.html?in=CESA-2009:0012\nhttp://www.securityspace.com/smysecure/catid.html?in=RHSA-2009:0012\nhttps://rhn.redhat.com/errata/RHSA-2009-0012.html\";\ntag_summary = \"The remote host is missing updates to netpbm announced in\nadvisory CESA-2009:0012.\";\n\n\n\nif(description)\n{\n script_id(63366);\n script_version(\"$Revision: 6650 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 13:43:12 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-02-13 20:43:17 +0100 (Fri, 13 Feb 2009)\");\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_name(\"CentOS Security Advisory CESA-2009:0012 (netpbm)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"netpbm\", rpm:\"netpbm~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-devel\", rpm:\"netpbm-devel~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"netpbm-progs\", rpm:\"netpbm-progs~10.25~2.1.el4.4\", rls:\"CentOS4\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:57:08", "description": "The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:311.", "cvss3": {}, "published": "2009-12-10T00:00:00", "type": "openvas", "title": "Mandriva Security Advisory MDVSA-2009:311 (ghostscript)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-0196", "CVE-2009-0792", "CVE-2008-3522", "CVE-2009-0584", "CVE-2007-6725", "CVE-2008-6679", "CVE-2009-0583", "CVE-2008-3520"], "modified": "2017-07-06T00:00:00", "id": "OPENVAS:66380", "href": "http://plugins.openvas.org/nasl.php?oid=66380", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_311.nasl 6573 2017-07-06 13:10:50Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:311 (ghostscript)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"For details on the issues addressed with this update, please\nvisit the referenced security advisories.\n\nPackages for 2008.0 are being provided due to extended support for\nCorporate products.\n\nThis update provides fixes for that vulnerabilities.\n\nAffected: 2008.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:311\";\ntag_summary = \"The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:311.\";\n\n \n\nif(description)\n{\n script_id(66380);\n script_version(\"$Revision: 6573 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:10:50 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-12-10 00:23:54 +0100 (Thu, 10 Dec 2009)\");\n script_cve_id(\"CVE-2007-6725\", \"CVE-2008-6679\", \"CVE-2009-0583\", \"CVE-2009-0584\", \"CVE-2009-0792\", \"CVE-2009-0196\", \"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandriva Security Advisory MDVSA-2009:311 (ghostscript)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"ghostscript\", rpm:\"ghostscript~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-common\", rpm:\"ghostscript-common~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-doc\", rpm:\"ghostscript-doc~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-dvipdf\", rpm:\"ghostscript-dvipdf~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-module-X\", rpm:\"ghostscript-module-X~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-X\", rpm:\"ghostscript-X~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8\", rpm:\"libgs8~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8-devel\", rpm:\"libgs8-devel~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1\", rpm:\"libijs1~0.35~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1-devel\", rpm:\"libijs1-devel~0.35~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8\", rpm:\"lib64gs8~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8-devel\", rpm:\"lib64gs8-devel~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1\", rpm:\"lib64ijs1~0.35~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1-devel\", rpm:\"lib64ijs1-devel~0.35~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-04-06T11:40:23", "description": "The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:311.", "cvss3": {}, "published": "2009-12-10T00:00:00", "type": "openvas", "title": "Mandriva Security Advisory MDVSA-2009:311 (ghostscript)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-0196", "CVE-2009-0792", "CVE-2008-3522", "CVE-2009-0584", "CVE-2007-6725", "CVE-2008-6679", "CVE-2009-0583", "CVE-2008-3520"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231066380", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231066380", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: mdksa_2009_311.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory MDVSA-2009:311 (ghostscript)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"For details on the issues addressed with this update, please\nvisit the referenced security advisories.\n\nPackages for 2008.0 are being provided due to extended support for\nCorporate products.\n\nThis update provides fixes for that vulnerabilities.\n\nAffected: 2008.0\";\ntag_solution = \"To upgrade automatically use MandrakeUpdate or urpmi. The verification\nof md5 checksums and GPG signatures is performed automatically for you.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:311\";\ntag_summary = \"The remote host is missing an update to ghostscript\nannounced via advisory MDVSA-2009:311.\";\n\n \n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.66380\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-12-10 00:23:54 +0100 (Thu, 10 Dec 2009)\");\n script_cve_id(\"CVE-2007-6725\", \"CVE-2008-6679\", \"CVE-2009-0583\", \"CVE-2009-0584\", \"CVE-2009-0792\", \"CVE-2009-0196\", \"CVE-2008-3520\", \"CVE-2008-3522\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Mandriva Security Advisory MDVSA-2009:311 (ghostscript)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"ghostscript\", rpm:\"ghostscript~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-common\", rpm:\"ghostscript-common~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-doc\", rpm:\"ghostscript-doc~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-dvipdf\", rpm:\"ghostscript-dvipdf~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-module-X\", rpm:\"ghostscript-module-X~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"ghostscript-X\", rpm:\"ghostscript-X~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8\", rpm:\"libgs8~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libgs8-devel\", rpm:\"libgs8-devel~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1\", rpm:\"libijs1~0.35~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"libijs1-devel\", rpm:\"libijs1-devel~0.35~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8\", rpm:\"lib64gs8~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64gs8-devel\", rpm:\"lib64gs8-devel~8.60~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1\", rpm:\"lib64ijs1~0.35~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"lib64ijs1-devel\", rpm:\"lib64ijs1-devel~0.35~55.3mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-12-04T11:29:43", "description": "The remote host is missing an update to jasper\nannounced via advisory USN-742-1.\n\nIt was discovered that JasPer did not correctly handle memory allocation\nwhen parsing certain malformed JPEG2000 images. If a user were tricked into\nopening a specially crafted image with an application that uses libjasper,\nan attacker could cause a denial of service and possibly execute arbitrary\ncode with the user's privileges. (CVE-2008-3520)\n\nIt was discovered that JasPer created temporary files in an insecure way.\nLocal users could exploit a race condition and cause a denial of service in\nlibjasper applications.\n(CVE-2008-3521)\n\nIt was discovered that JasPer did not correctly handle certain formatting\noperations. If a user were tricked into opening a specially crafted image\nwith an application that uses libjasper, an attacker could cause a denial\nof service and possibly execute arbitrary code with the user's privileges.\n(CVE-2008-3522)", "cvss3": {}, "published": "2009-03-31T00:00:00", "type": "openvas", "title": "Ubuntu USN-742-1 (jasper)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-0772", "CVE-2009-0352", "CVE-2008-3522", "CVE-2009-0584", "CVE-2009-0583", "CVE-2009-0774", "CVE-2008-4552", "CVE-2008-3520", "CVE-2009-0776", "CVE-2008-3521"], "modified": "2017-12-01T00:00:00", "id": "OPENVAS:63698", "href": "http://plugins.openvas.org/nasl.php?oid=63698", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: ubuntu_742_1.nasl 7969 2017-12-01 09:23:16Z santu $\n# $Id: ubuntu_742_1.nasl 7969 2017-12-01 09:23:16Z santu $\n# Description: Auto-generated from advisory USN-742-1 (jasper)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_solution = \"The problem can be corrected by upgrading your system to the\n following package versions:\n\nUbuntu 6.06 LTS:\n libjasper-1.701-1 1.701.0-2ubuntu0.6.06.1\n\nUbuntu 7.10:\n libjasper1 1.900.1-3ubuntu0.7.10.1\n\nUbuntu 8.04 LTS:\n libjasper1 1.900.1-3ubuntu0.8.04.1\n\nUbuntu 8.10:\n libjasper1 1.900.1-5ubuntu0.1\n\nIn general, a standard system upgrade is sufficient to effect the\nnecessary changes.\n\nhttps://secure1.securityspace.com/smysecure/catid.html?in=USN-742-1\";\n\ntag_summary = \"The remote host is missing an update to jasper\nannounced via advisory USN-742-1.\n\nIt was discovered that JasPer did not correctly handle memory allocation\nwhen parsing certain malformed JPEG2000 images. If a user were tricked into\nopening a specially crafted image with an application that uses libjasper,\nan attacker could cause a denial of service and possibly execute arbitrary\ncode with the user's privileges. (CVE-2008-3520)\n\nIt was discovered that JasPer created temporary files in an insecure way.\nLocal users could exploit a race condition and cause a denial of service in\nlibjasper applications.\n(CVE-2008-3521)\n\nIt was discovered that JasPer did not correctly handle certain formatting\noperations. If a user were tricked into opening a specially crafted image\nwith an application that uses libjasper, an attacker could cause a denial\nof service and possibly execute arbitrary code with the user's privileges.\n(CVE-2008-3522)\";\n\n \n\n\nif(description)\n{\n script_id(63698);\n script_version(\"$Revision: 7969 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-01 10:23:16 +0100 (Fri, 01 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-31 19:20:21 +0200 (Tue, 31 Mar 2009)\");\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\", \"CVE-2009-0583\", \"CVE-2009-0584\", \"CVE-2008-4552\", \"CVE-2009-0352\", \"CVE-2009-0772\", \"CVE-2009-0774\", \"CVE-2009-0776\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_name(\"Ubuntu USN-742-1 (jasper)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n script_xref(name: \"URL\" , value: \"http://www.ubuntu.com/usn/usn-742-1/\");\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libjasper-1.701-1\", ver:\"1.701.0-2ubuntu0.6.06.1\", rls:\"UBUNTU6.06 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libjasper-1.701-dev\", ver:\"1.701.0-2ubuntu0.6.06.1\", rls:\"UBUNTU6.06 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libjasper-runtime\", ver:\"1.701.0-2ubuntu0.6.06.1\", rls:\"UBUNTU6.06 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libjasper-dev\", ver:\"1.900.1-3ubuntu0.7.10.1\", rls:\"UBUNTU7.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libjasper1\", ver:\"1.900.1-3ubuntu0.7.10.1\", rls:\"UBUNTU7.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libjasper-runtime\", ver:\"1.900.1-3ubuntu0.7.10.1\", rls:\"UBUNTU7.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libjasper-dev\", ver:\"1.900.1-3ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libjasper1\", ver:\"1.900.1-3ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libjasper-runtime\", ver:\"1.900.1-3ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libjasper-dev\", ver:\"1.900.1-5ubuntu0.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libjasper1\", ver:\"1.900.1-5ubuntu0.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libjasper-runtime\", ver:\"1.900.1-5ubuntu0.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-thunderbird-dev\", ver:\"1.5.0.13+1.5.0.15~prepatch080614k-0ubuntu0.6.06.1\", rls:\"UBUNTU6.06 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-thunderbird-inspector\", ver:\"1.5.0.13+1.5.0.15~prepatch080614k-0ubuntu0.6.06.1\", rls:\"UBUNTU6.06 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-thunderbird-typeaheadfind\", ver:\"1.5.0.13+1.5.0.15~prepatch080614k-0ubuntu0.6.06.1\", rls:\"UBUNTU6.06 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-thunderbird\", ver:\"1.5.0.13+1.5.0.15~prepatch080614k-0ubuntu0.6.06.1\", rls:\"UBUNTU6.06 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-thunderbird-dev\", ver:\"2.0.0.21+nobinonly-0ubuntu0.7.10.1\", rls:\"UBUNTU7.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-thunderbird\", ver:\"2.0.0.21+nobinonly-0ubuntu0.7.10.1\", rls:\"UBUNTU7.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"thunderbird-dev\", ver:\"2.0.0.21+nobinonly-0ubuntu0.7.10.1\", rls:\"UBUNTU7.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"thunderbird-gnome-support\", ver:\"2.0.0.21+nobinonly-0ubuntu0.7.10.1\", rls:\"UBUNTU7.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"thunderbird\", ver:\"2.0.0.21+nobinonly-0ubuntu0.7.10.1\", rls:\"UBUNTU7.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-thunderbird-dev\", ver:\"2.0.0.21+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-thunderbird\", ver:\"2.0.0.21+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"thunderbird-dev\", ver:\"2.0.0.21+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"thunderbird-gnome-support\", ver:\"2.0.0.21+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"thunderbird\", ver:\"2.0.0.21+nobinonly-0ubuntu0.8.04.1\", rls:\"UBUNTU8.04 LTS\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-thunderbird-dev\", ver:\"2.0.0.21+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"mozilla-thunderbird\", ver:\"2.0.0.21+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"thunderbird-dev\", ver:\"2.0.0.21+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"thunderbird-gnome-support\", ver:\"2.0.0.21+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"thunderbird\", ver:\"2.0.0.21+nobinonly-0ubuntu0.8.10.1\", rls:\"UBUNTU8.10\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-07-24T12:49:25", "description": "The remote host is missing an update to ghostscript\nannounced via advisory DSA 2080-1.", "cvss3": {}, "published": "2010-08-21T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2080-1 (ghostscript)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-0196", "CVE-2009-4270", "CVE-2009-0792", "CVE-2008-3522", "CVE-2007-6725", "CVE-2008-6679", "CVE-2010-1869"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:67835", "href": "http://plugins.openvas.org/nasl.php?oid=67835", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2080_1.nasl 6614 2017-07-07 12:09:12Z cfischer $\n# Description: Auto-generated from advisory DSA 2080-1 (ghostscript)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Several security issues have been discovered in Ghostscript, the GPL\nPostScript/PDF interpreter, which might lead to the execution of\narbitrary code if a user processes a malformed PDF or Postscript file.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 8.62.dfsg.1-3.2lenny4.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 8.71~dfsg-4.\n\nWe recommend that you upgrade your ghostscript packages.\";\ntag_summary = \"The remote host is missing an update to ghostscript\nannounced via advisory DSA 2080-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202080-1\";\n\n\nif(description)\n{\n script_id(67835);\n script_version(\"$Revision: 6614 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:09:12 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-21 08:54:16 +0200 (Sat, 21 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2007-6725\", \"CVE-2008-3522\", \"CVE-2008-6679\", \"CVE-2009-0196\", \"CVE-2009-0792\", \"CVE-2009-4270\", \"CVE-2010-1869\");\n script_name(\"Debian Security Advisory DSA 2080-1 (ghostscript)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"gs-gpl\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gs-aladdin\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"ghostscript-doc\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gs\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gs-common\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gs-esp\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"ghostscript-x\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgs-dev\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"ghostscript\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgs8\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-01-08T12:54:25", "description": "The remote host is missing an update to ghostscript\nannounced via advisory DSA 2080-1.", "cvss3": {}, "published": "2010-08-21T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 2080-1 (ghostscript)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-0196", "CVE-2009-4270", "CVE-2009-0792", "CVE-2008-3522", "CVE-2007-6725", "CVE-2008-6679", "CVE-2010-1869"], "modified": "2018-01-05T00:00:00", "id": "OPENVAS:136141256231067835", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231067835", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_2080_1.nasl 8296 2018-01-05 07:28:01Z teissa $\n# Description: Auto-generated from advisory DSA 2080-1 (ghostscript)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Several security issues have been discovered in Ghostscript, the GPL\nPostScript/PDF interpreter, which might lead to the execution of\narbitrary code if a user processes a malformed PDF or Postscript file.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 8.62.dfsg.1-3.2lenny4.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 8.71~dfsg-4.\n\nWe recommend that you upgrade your ghostscript packages.\";\ntag_summary = \"The remote host is missing an update to ghostscript\nannounced via advisory DSA 2080-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202080-1\";\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.67835\");\n script_version(\"$Revision: 8296 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-01-05 08:28:01 +0100 (Fri, 05 Jan 2018) $\");\n script_tag(name:\"creation_date\", value:\"2010-08-21 08:54:16 +0200 (Sat, 21 Aug 2010)\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cve_id(\"CVE-2007-6725\", \"CVE-2008-3522\", \"CVE-2008-6679\", \"CVE-2009-0196\", \"CVE-2009-0792\", \"CVE-2009-4270\", \"CVE-2010-1869\");\n script_name(\"Debian Security Advisory DSA 2080-1 (ghostscript)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"gs-gpl\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gs-aladdin\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"ghostscript-doc\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gs\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gs-common\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gs-esp\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"ghostscript-x\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgs-dev\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"ghostscript\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgs8\", ver:\"8.62.dfsg.1-3.2lenny4\", rls:\"DEB5.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "nessus": [{"lastseen": "2021-08-19T13:06:21", "description": "- Tue Oct 13 2009 Rex Dieter <rdieter at fedoraproject.org> - 1.900.1-13\n\n - CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)\n\n - CVE-2008-3522 jasper: possible buffer overflow in jas_stream_printf() (#461478)\n\n - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 1.900.1-12\n\n - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\n\n - Sat Jul 18 2009 Rex Dieter <rdieter at fedoraproject.org> - 1.900.1-11\n\n - FTBFS jasper-1.900.1-10.fc11 (#511743)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2009-10-28T00:00:00", "type": "nessus", "title": "Fedora 11 : jasper-1.900.1-13.fc11 (2009-10761)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:jasper", "cpe:/o:fedoraproject:fedora:11"], "id": "FEDORA_2009-10761.NASL", "href": "https://www.tenable.com/plugins/nessus/42275", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2009-10761.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(42275);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_bugtraq_id(31470);\n script_xref(name:\"FEDORA\", value:\"2009-10761\");\n\n script_name(english:\"Fedora 11 : jasper-1.900.1-13.fc11 (2009-10761)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Tue Oct 13 2009 Rex Dieter <rdieter at\n fedoraproject.org> - 1.900.1-13\n\n - CVE-2008-3520 jasper: multiple integer overflows in\n jas_alloc calls (#461476)\n\n - CVE-2008-3522 jasper: possible buffer overflow in\n jas_stream_printf() (#461478)\n\n - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at\n lists.fedoraproject.org> - 1.900.1-12\n\n - Rebuilt for\n https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\n\n - Sat Jul 18 2009 Rex Dieter <rdieter at\n fedoraproject.org> - 1.900.1-11\n\n - FTBFS jasper-1.900.1-10.fc11 (#511743)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=461476\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=461478\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-October/030282.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?10a4fd62\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected jasper package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:jasper\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:11\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/10/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/10/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^11([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 11.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC11\", reference:\"jasper-1.900.1-13.fc11\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jasper\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:09:13", "description": "The remote host is affected by the vulnerability described in GLSA-200812-18 (JasPer: User-assisted execution of arbitrary code)\n\n Marc Espie and Christian Weisgerber have discovered multiple vulnerabilities in JasPer:\n Multiple integer overflows might allow for insufficient memory allocation, leading to heap-based buffer overflows (CVE-2008-3520).\n The jas_stream_printf() function in libjasper/base/jas_stream.c uses vsprintf() to write user-provided data to a static to a buffer, leading to an overflow (CVE-2008-3522).\n Impact :\n\n Remote attackers could entice a user or automated system to process specially crafted jpeg2k files with an application using JasPer, possibly leading to the execution of arbitrary code.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {"score": null, "vector": null}, "published": "2008-12-17T00:00:00", "type": "nessus", "title": "GLSA-200812-18 : JasPer: User-assisted execution of arbitrary code", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:jasper", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-200812-18.NASL", "href": "https://www.tenable.com/plugins/nessus/35189", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200812-18.\n#\n# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(35189);\n script_version(\"1.17\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_bugtraq_id(31470);\n script_xref(name:\"GLSA\", value:\"200812-18\");\n\n script_name(english:\"GLSA-200812-18 : JasPer: User-assisted execution of arbitrary code\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200812-18\n(JasPer: User-assisted execution of arbitrary code)\n\n Marc Espie and Christian Weisgerber have discovered multiple\n vulnerabilities in JasPer:\n Multiple integer overflows might allow for insufficient memory\n allocation, leading to heap-based buffer overflows (CVE-2008-3520).\n The jas_stream_printf() function in libjasper/base/jas_stream.c uses\n vsprintf() to write user-provided data to a static to a buffer, leading\n to an overflow (CVE-2008-3522).\n \nImpact :\n\n Remote attackers could entice a user or automated system to process\n specially crafted jpeg2k files with an application using JasPer,\n possibly leading to the execution of arbitrary code.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200812-18\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All JasPer users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=media-libs/jasper-1.900.1-r3'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:jasper\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/12/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/12/17\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"media-libs/jasper\", unaffected:make_list(\"ge 1.900.1-r3\"), vulnerable:make_list(\"lt 1.900.1-r3\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"JasPer\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:06:21", "description": "- Tue Oct 13 2009 Rex Dieter <rdieter at fedoraproject.org> - 1.900.1-13\n\n - CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)\n\n - CVE-2008-3522 jasper: possible buffer overflow in jas_stream_printf() (#461478)\n\n - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 1.900.1-12\n\n - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\n\n - Sat Jul 18 2009 Rex Dieter <rdieter at fedoraproject.org> - 1.900.1-11\n\n - FTBFS jasper-1.900.1-10.fc11 (#511743)\n\n - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 1.900.1-10\n\n - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2009-10-28T00:00:00", "type": "nessus", "title": "Fedora 10 : jasper-1.900.1-13.fc10 (2009-10737)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:jasper", "cpe:/o:fedoraproject:fedora:10"], "id": "FEDORA_2009-10737.NASL", "href": "https://www.tenable.com/plugins/nessus/42274", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2009-10737.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(42274);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\");\n script_bugtraq_id(31470);\n script_xref(name:\"FEDORA\", value:\"2009-10737\");\n\n script_name(english:\"Fedora 10 : jasper-1.900.1-13.fc10 (2009-10737)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Tue Oct 13 2009 Rex Dieter <rdieter at\n fedoraproject.org> - 1.900.1-13\n\n - CVE-2008-3520 jasper: multiple integer overflows in\n jas_alloc calls (#461476)\n\n - CVE-2008-3522 jasper: possible buffer overflow in\n jas_stream_printf() (#461478)\n\n - Fri Jul 24 2009 Fedora Release Engineering <rel-eng at\n lists.fedoraproject.org> - 1.900.1-12\n\n - Rebuilt for\n https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\n\n - Sat Jul 18 2009 Rex Dieter <rdieter at\n fedoraproject.org> - 1.900.1-11\n\n - FTBFS jasper-1.900.1-10.fc11 (#511743)\n\n - Wed Feb 25 2009 Fedora Release Engineering <rel-eng at\n lists.fedoraproject.org> - 1.900.1-10\n\n - Rebuilt for\n https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=461476\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=461478\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2009-October/030269.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ed29e31a\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected jasper package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:jasper\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/10/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/10/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^10([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 10.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC10\", reference:\"jasper-1.900.1-13.fc10\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jasper\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:07:37", "description": "Multiple security vulnerabilities has been identified and fixed in ghostscript :\n\nMultiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation (CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (CVE-2008-3522).\n\nPreviousely the ghostscript packages were statically built against a bundled and private copy of the jasper library. This update makes ghostscript link against the shared system jasper library which makes it easier to address presumptive future security issues in the jasper library.", "cvss3": {"score": null, "vector": null}, "published": "2009-06-28T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : ghostscript (MDVSA-2009:144)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:ghostscript", "p-cpe:/a:mandriva:linux:ghostscript-X", "p-cpe:/a:mandriva:linux:ghostscript-common", "p-cpe:/a:mandriva:linux:ghostscript-doc", "p-cpe:/a:mandriva:linux:ghostscript-dvipdf", "p-cpe:/a:mandriva:linux:ghostscript-module-X", "p-cpe:/a:mandriva:linux:lib64gs8", "p-cpe:/a:mandriva:linux:lib64gs8-devel", "p-cpe:/a:mandriva:linux:lib64ijs1", "p-cpe:/a:mandriva:linux:lib64ijs1-devel", "p-cpe:/a:mandriva:linux:libgs8", "p-cpe:/a:mandriva:linux:libgs8-devel", "p-cpe:/a:mandriva:linux:libijs1", "p-cpe:/a:mandriva:linux:libijs1-devel", "cpe:/o:mandriva:linux:2008.1", "cpe:/o:mandriva:linux:2009.0", "cpe:/o:mandriva:linux:2009.1"], "id": "MANDRIVA_MDVSA-2009-144.NASL", "href": "https://www.tenable.com/plugins/nessus/39562", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2009:144. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(39562);\n script_version(\"1.18\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2008-3520\",\"CVE-2008-3522\");\n script_bugtraq_id(31470);\n script_xref(name:\"MDVSA\", value:\"2009:144\");\n\n script_name(english:\"Mandriva Linux Security Advisory : ghostscript (MDVSA-2009:144)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple security vulnerabilities has been identified and fixed in\nghostscript :\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via vectors\nrelated to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nPreviousely the ghostscript packages were statically built against a\nbundled and private copy of the jasper library. This update makes\nghostscript link against the shared system jasper library which makes\nit easier to address presumptive future security issues in the jasper\nlibrary.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript-X\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript-dvipdf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript-module-X\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64gs8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64gs8-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64ijs1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64ijs1-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libgs8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libgs8-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libijs1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libijs1-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2008.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2009.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2009.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/06/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/06/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2008.1\", reference:\"ghostscript-8.61-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", reference:\"ghostscript-X-8.61-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", reference:\"ghostscript-common-8.61-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", reference:\"ghostscript-doc-8.61-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", reference:\"ghostscript-dvipdf-8.61-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", reference:\"ghostscript-module-X-8.61-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", cpu:\"x86_64\", reference:\"lib64gs8-8.61-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", cpu:\"x86_64\", reference:\"lib64gs8-devel-8.61-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", cpu:\"x86_64\", reference:\"lib64ijs1-0.35-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", cpu:\"x86_64\", reference:\"lib64ijs1-devel-0.35-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", cpu:\"i386\", reference:\"libgs8-8.61-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", cpu:\"i386\", reference:\"libgs8-devel-8.61-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", cpu:\"i386\", reference:\"libijs1-0.35-60.2mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", cpu:\"i386\", reference:\"libijs1-devel-0.35-60.2mdv2008.1\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2009.0\", reference:\"ghostscript-8.63-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", reference:\"ghostscript-X-8.63-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", reference:\"ghostscript-common-8.63-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", reference:\"ghostscript-doc-8.63-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", reference:\"ghostscript-dvipdf-8.63-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", reference:\"ghostscript-module-X-8.63-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"x86_64\", reference:\"lib64gs8-8.63-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"x86_64\", reference:\"lib64gs8-devel-8.63-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"x86_64\", reference:\"lib64ijs1-0.35-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"x86_64\", reference:\"lib64ijs1-devel-0.35-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"i386\", reference:\"libgs8-8.63-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"i386\", reference:\"libgs8-devel-8.63-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"i386\", reference:\"libijs1-0.35-62.2mdv2009.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.0\", cpu:\"i386\", reference:\"libijs1-devel-0.35-62.2mdv2009.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2009.1\", reference:\"ghostscript-8.64-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"ghostscript-X-8.64-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"ghostscript-common-8.64-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"ghostscript-doc-8.64-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"ghostscript-dvipdf-8.64-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", reference:\"ghostscript-module-X-8.64-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"x86_64\", reference:\"lib64gs8-8.64-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"x86_64\", reference:\"lib64gs8-devel-8.64-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"x86_64\", reference:\"lib64ijs1-0.35-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"x86_64\", reference:\"lib64ijs1-devel-0.35-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"i386\", reference:\"libgs8-8.64-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"i386\", reference:\"libgs8-devel-8.64-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"i386\", reference:\"libijs1-0.35-65.1mdv2009.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2009.1\", cpu:\"i386\", reference:\"libijs1-devel-0.35-65.1mdv2009.1\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:06:51", "description": "Multiple potentially dangerous integer overflows, buffer overflows, and a problem with temporary files have been fixed. CVE-2008-3520, CVE-2008-3521, CVE-2008-3522)", "cvss3": {"score": null, "vector": null}, "published": "2009-09-24T00:00:00", "type": "nessus", "title": "SuSE9 Security Update : jasper (YOU Patch Number 12295)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3521", "CVE-2008-3522"], "modified": "2021-01-14T00:00:00", "cpe": ["cpe:/o:suse:suse_linux"], "id": "SUSE9_12295.NASL", "href": "https://www.tenable.com/plugins/nessus/41255", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The text description of this plugin is (C) Novell, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(41255);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n\n script_name(english:\"SuSE9 Security Update : jasper (YOU Patch Number 12295)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 9 host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple potentially dangerous integer overflows, buffer overflows,\nand a problem with temporary files have been fixed. CVE-2008-3520,\nCVE-2008-3521, CVE-2008-3522)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2008-3520.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2008-3521.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2008-3522.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply YOU patch number 12295.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(59, 119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:suse:suse_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/11/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/09/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) exit(0, \"Local checks are not enabled.\");\nif (!get_kb_item(\"Host/SuSE/release\")) exit(0, \"The host is not running SuSE.\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) exit(1, \"Could not obtain the list of installed packages.\");\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) exit(1, \"Failed to determine the architecture type.\");\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") exit(1, \"Local checks for SuSE 9 on the '\"+cpu+\"' architecture have not been implemented.\");\n\n\nflag = 0;\nif (rpm_check(release:\"SUSE9\", reference:\"jasper-1.701.0-1.10\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"libjasper-1.701.0-1.10\")) flag++;\nif (rpm_check(release:\"SUSE9\", cpu:\"x86_64\", reference:\"libjasper-32bit-9-200811141502\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse exit(0, \"The host is not affected.\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:08:14", "description": "It was discovered that JasPer did not correctly handle memory allocation when parsing certain malformed JPEG2000 images. If a user were tricked into opening a specially crafted image with an application that uses libjasper, an attacker could cause a denial of service and possibly execute arbitrary code with the user's privileges. (CVE-2008-3520)\n\nIt was discovered that JasPer created temporary files in an insecure way. Local users could exploit a race condition and cause a denial of service in libjasper applications. (CVE-2008-3521)\n\nIt was discovered that JasPer did not correctly handle certain formatting operations. If a user were tricked into opening a specially crafted image with an application that uses libjasper, an attacker could cause a denial of service and possibly execute arbitrary code with the user's privileges. (CVE-2008-3522).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2009-04-23T00:00:00", "type": "nessus", "title": "Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : jasper vulnerabilities (USN-742-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3521", "CVE-2008-3522"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:libjasper-1.701-1", "p-cpe:/a:canonical:ubuntu_linux:libjasper-1.701-dev", "p-cpe:/a:canonical:ubuntu_linux:libjasper-dev", "p-cpe:/a:canonical:ubuntu_linux:libjasper-runtime", "p-cpe:/a:canonical:ubuntu_linux:libjasper1", "cpe:/o:canonical:ubuntu_linux:6.06:-:lts", "cpe:/o:canonical:ubuntu_linux:7.10", "cpe:/o:canonical:ubuntu_linux:8.04:-:lts", "cpe:/o:canonical:ubuntu_linux:8.10"], "id": "UBUNTU_USN-742-1.NASL", "href": "https://www.tenable.com/plugins/nessus/37359", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-742-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(37359);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_bugtraq_id(31470);\n script_xref(name:\"USN\", value:\"742-1\");\n\n script_name(english:\"Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : jasper vulnerabilities (USN-742-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that JasPer did not correctly handle memory\nallocation when parsing certain malformed JPEG2000 images. If a user\nwere tricked into opening a specially crafted image with an\napplication that uses libjasper, an attacker could cause a denial of\nservice and possibly execute arbitrary code with the user's\nprivileges. (CVE-2008-3520)\n\nIt was discovered that JasPer created temporary files in an insecure\nway. Local users could exploit a race condition and cause a denial of\nservice in libjasper applications. (CVE-2008-3521)\n\nIt was discovered that JasPer did not correctly handle certain\nformatting operations. If a user were tricked into opening a specially\ncrafted image with an application that uses libjasper, an attacker\ncould cause a denial of service and possibly execute arbitrary code\nwith the user's privileges. (CVE-2008-3522).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/742-1/\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(59, 119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libjasper-1.701-1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libjasper-1.701-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libjasper-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libjasper-runtime\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libjasper1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:6.06:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:7.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:8.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:8.10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/03/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/04/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2009-2019 Canonical, Inc. / NASL script (C) 2009-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(6\\.06|7\\.10|8\\.04|8\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 6.06 / 7.10 / 8.04 / 8.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"6.06\", pkgname:\"libjasper-1.701-1\", pkgver:\"1.701.0-2ubuntu0.6.06.1\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"libjasper-1.701-dev\", pkgver:\"1.701.0-2ubuntu0.6.06.1\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"libjasper-runtime\", pkgver:\"1.701.0-2ubuntu0.6.06.1\")) flag++;\nif (ubuntu_check(osver:\"7.10\", pkgname:\"libjasper-dev\", pkgver:\"1.900.1-3ubuntu0.7.10.1\")) flag++;\nif (ubuntu_check(osver:\"7.10\", pkgname:\"libjasper-runtime\", pkgver:\"1.900.1-3ubuntu0.7.10.1\")) flag++;\nif (ubuntu_check(osver:\"7.10\", pkgname:\"libjasper1\", pkgver:\"1.900.1-3ubuntu0.7.10.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"libjasper-dev\", pkgver:\"1.900.1-3ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"libjasper-runtime\", pkgver:\"1.900.1-3ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.04\", pkgname:\"libjasper1\", pkgver:\"1.900.1-3ubuntu0.8.04.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"libjasper-dev\", pkgver:\"1.900.1-5ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"libjasper-runtime\", pkgver:\"1.900.1-5ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"8.10\", pkgname:\"libjasper1\", pkgver:\"1.900.1-5ubuntu0.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjasper-1.701-1 / libjasper-1.701-dev / libjasper-dev / etc\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:09:16", "description": "Multiple, potentially dangerous integer overflows, buffer overflows and a problem with temporary files have been fixed (CVE-2008-3520, CVE-2008-3521, CVE-2008-3522).", "cvss3": {"score": null, "vector": null}, "published": "2008-12-01T00:00:00", "type": "nessus", "title": "openSUSE 10 Security Update : jasper (jasper-5771)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3521", "CVE-2008-3522"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:jasper", "p-cpe:/a:novell:opensuse:libjasper", "p-cpe:/a:novell:opensuse:libjasper-32bit", "p-cpe:/a:novell:opensuse:libjasper-devel", "cpe:/o:novell:opensuse:10.2", "cpe:/o:novell:opensuse:10.3"], "id": "SUSE_JASPER-5771.NASL", "href": "https://www.tenable.com/plugins/nessus/34982", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update jasper-5771.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(34982);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n\n script_name(english:\"openSUSE 10 Security Update : jasper (jasper-5771)\");\n script_summary(english:\"Check for the jasper-5771 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple, potentially dangerous integer overflows, buffer overflows\nand a problem with temporary files have been fixed (CVE-2008-3520,\nCVE-2008-3521, CVE-2008-3522).\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected jasper packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(59, 119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:jasper\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/11/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/12/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE10\\.2|SUSE10\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"10.2 / 10.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE10.2\", reference:\"jasper-1.701.0-41\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"libjasper-1.701.0-41\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", cpu:\"x86_64\", reference:\"libjasper-32bit-1.701.0-41\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"jasper-1.900.1-44.3\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"libjasper-1.900.1-44.3\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"libjasper-devel-1.900.1-44.3\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", cpu:\"x86_64\", reference:\"libjasper-32bit-1.900.1-44.3\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jasper / libjasper / libjasper-32bit / libjasper-devel\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:05:57", "description": "Multiple security vulnerabilities has been identified and fixed in netpbm :\n\nMultiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation (CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (CVE-2008-3522).\n\npamperspective in Netpbm before 10.35.48 does not properly calculate a window height, which allows context-dependent attackers to cause a denial of service (crash) via a crafted image file that triggers an out-of-bounds read (CVE-2008-4799).\n\nPackages for 2008.0 are provided for Corporate Desktop 2008.0 customers\n\nThis update fixes this vulnerability.", "cvss3": {"score": null, "vector": null}, "published": "2009-12-07T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : netpbm (MDVSA-2009:317)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522", "CVE-2008-4799"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:lib64netpbm-devel", "p-cpe:/a:mandriva:linux:lib64netpbm-static-devel", "p-cpe:/a:mandriva:linux:lib64netpbm10", "p-cpe:/a:mandriva:linux:libnetpbm-devel", "p-cpe:/a:mandriva:linux:libnetpbm-static-devel", "p-cpe:/a:mandriva:linux:libnetpbm10", "p-cpe:/a:mandriva:linux:netpbm", "cpe:/o:mandriva:linux:2008.0"], "id": "MANDRIVA_MDVSA-2009-317.NASL", "href": "https://www.tenable.com/plugins/nessus/43020", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2009:317. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(43020);\n script_version(\"1.18\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2008-3520\",\n \"CVE-2008-3522\",\n \"CVE-2008-4799\"\n );\n script_bugtraq_id(31470);\n script_xref(name:\"MDVSA\", value:\"2009:317\");\n\n script_name(english:\"Mandriva Linux Security Advisory : netpbm (MDVSA-2009:317)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple security vulnerabilities has been identified and fixed in\nnetpbm :\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via vectors\nrelated to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\npamperspective in Netpbm before 10.35.48 does not properly calculate a\nwindow height, which allows context-dependent attackers to cause a\ndenial of service (crash) via a crafted image file that triggers an\nout-of-bounds read (CVE-2008-4799).\n\nPackages for 2008.0 are provided for Corporate Desktop 2008.0\ncustomers\n\nThis update fixes this vulnerability.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64netpbm-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64netpbm-static-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64netpbm10\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libnetpbm-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libnetpbm-static-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libnetpbm10\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:netpbm\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2008.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/12/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/12/07\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64netpbm-devel-10.34-8.2mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64netpbm-static-devel-10.34-8.2mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64netpbm10-10.34-8.2mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libnetpbm-devel-10.34-8.2mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libnetpbm-static-devel-10.34-8.2mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libnetpbm10-10.34-8.2mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"netpbm-10.34-8.2mdv2008.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:09:11", "description": "Multiple, potentially dangerous integer overflows, buffer overflows and a problem with temporary files have been fixed. (CVE-2008-3520 / CVE-2008-3521 / CVE-2008-3522)", "cvss3": {"score": null, "vector": null}, "published": "2008-11-26T00:00:00", "type": "nessus", "title": "SuSE 10 Security Update : jasper (ZYPP Patch Number 5782)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3521", "CVE-2008-3522"], "modified": "2021-01-14T00:00:00", "cpe": ["cpe:/o:suse:suse_linux"], "id": "SUSE_JASPER-5782.NASL", "href": "https://www.tenable.com/plugins/nessus/34968", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The text description of this plugin is (C) Novell, Inc.\n#\n\nif (NASL_LEVEL < 3000) exit(0);\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(34968);\n script_version(\"1.20\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n\n script_name(english:\"SuSE 10 Security Update : jasper (ZYPP Patch Number 5782)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 10 host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple, potentially dangerous integer overflows, buffer overflows\nand a problem with temporary files have been fixed. (CVE-2008-3520 /\nCVE-2008-3521 / CVE-2008-3522)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2008-3520.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2008-3521.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2008-3522.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply ZYPP patch number 5782.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(59, 119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:suse:suse_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/11/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/11/26\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) exit(0, \"Local checks are not enabled.\");\nif (!get_kb_item(\"Host/SuSE/release\")) exit(0, \"The host is not running SuSE.\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) exit(1, \"Could not obtain the list of installed packages.\");\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) exit(1, \"Failed to determine the architecture type.\");\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") exit(1, \"Local checks for SuSE 10 on the '\"+cpu+\"' architecture have not been implemented.\");\n\n\nflag = 0;\nif (rpm_check(release:\"SLED10\", sp:1, reference:\"libjasper-1.701.0-16.10\")) flag++;\nif (rpm_check(release:\"SLED10\", sp:1, cpu:\"x86_64\", reference:\"libjasper-32bit-1.701.0-16.10\")) flag++;\nif (rpm_check(release:\"SLED10\", sp:2, reference:\"libjasper-1.701.0-16.10\")) flag++;\nif (rpm_check(release:\"SLED10\", sp:2, cpu:\"x86_64\", reference:\"libjasper-32bit-1.701.0-16.10\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:1, reference:\"jasper-1.701.0-16.10\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:1, reference:\"libjasper-1.701.0-16.10\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:1, cpu:\"x86_64\", reference:\"libjasper-32bit-1.701.0-16.10\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:2, reference:\"jasper-1.701.0-16.10\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:2, reference:\"libjasper-1.701.0-16.10\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:2, cpu:\"x86_64\", reference:\"libjasper-32bit-1.701.0-16.10\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse exit(0, \"The host is not affected.\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:07:22", "description": "Multiple, potentially dangerous integer overflows, buffer overflows and a problem with temporary files have been fixed (CVE-2008-3520, CVE-2008-3521, CVE-2008-3522).", "cvss3": {"score": null, "vector": null}, "published": "2009-07-21T00:00:00", "type": "nessus", "title": "openSUSE Security Update : jasper (jasper-303)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3521", "CVE-2008-3522"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:jasper", "p-cpe:/a:novell:opensuse:libjasper", "p-cpe:/a:novell:opensuse:libjasper-32bit", "p-cpe:/a:novell:opensuse:libjasper-devel", "cpe:/o:novell:opensuse:11.0"], "id": "SUSE_11_0_JASPER-081114.NASL", "href": "https://www.tenable.com/plugins/nessus/39995", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update jasper-303.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(39995);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n\n script_name(english:\"openSUSE Security Update : jasper (jasper-303)\");\n script_summary(english:\"Check for the jasper-303 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple, potentially dangerous integer overflows, buffer overflows\nand a problem with temporary files have been fixed (CVE-2008-3520,\nCVE-2008-3521, CVE-2008-3522).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=392410\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected jasper packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_cwe_id(59, 119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:jasper\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:11.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/11/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/07/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE11\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"11.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE11.0\", reference:\"jasper-1.900.1-98.3\") ) flag++;\nif ( rpm_check(release:\"SUSE11.0\", reference:\"libjasper-1.900.1-98.3\") ) flag++;\nif ( rpm_check(release:\"SUSE11.0\", reference:\"libjasper-devel-1.900.1-98.3\") ) flag++;\nif ( rpm_check(release:\"SUSE11.0\", cpu:\"x86_64\", reference:\"libjasper-32bit-1.900.1-98.3\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jasper / libjasper / libjasper-32bit / libjasper-devel\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:55:13", "description": "Fedora reports :\n\nJasPer fails to properly decode marker segments and other sections in malformed JPEG2000 files. Malformed inputs can cause heap buffer overflows which in turn may result in execution of attacker-controlled code.", "cvss3": {"score": null, "vector": null}, "published": "2013-04-18T00:00:00", "type": "nessus", "title": "FreeBSD : jasper -- buffer overflow (8ff84335-a7da-11e2-b3f5-003067c2616f)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522", "CVE-2011-4516", "CVE-2011-4517"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:jasper", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_8FF84335A7DA11E2B3F5003067C2616F.NASL", "href": "https://www.tenable.com/plugins/nessus/66012", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2019 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(66012);\n script_version(\"1.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\", \"CVE-2011-4516\", \"CVE-2011-4517\");\n script_xref(name:\"CERT\", value:\"887409\");\n\n script_name(english:\"FreeBSD : jasper -- buffer overflow (8ff84335-a7da-11e2-b3f5-003067c2616f)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Fedora reports :\n\nJasPer fails to properly decode marker segments and other sections in\nmalformed JPEG2000 files. Malformed inputs can cause heap buffer\noverflows which in turn may result in execution of attacker-controlled\ncode.\"\n );\n # https://vuxml.freebsd.org/freebsd/8ff84335-a7da-11e2-b3f5-003067c2616f.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ccf3e5eb\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:jasper\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2011/12/09\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2013/04/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/04/18\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"jasper<1.900.1_12\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:07:29", "description": "Multiple security vulnerabilities has been identified and fixed in jasper :\n\nThe jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer JPEG-2000 library (libjasper) before 1.900 allows remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the heap via malformed image files, as originally demonstrated using imagemagick convert (CVE-2007-2721).\n\nMultiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation (CVE-2008-3520).\n\nThe jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to overwrite arbitrary files via a symlink attack on a tmp.XXXXXXXXXX temporary file (CVE-2008-3521).\n\nBuffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (CVE-2008-3522).\n\nThe updated packages have been patched to prevent this.\n\nUpdate :\n\nPackages for 2008.0 are provided for Corporate Desktop 2008.0 customers", "cvss3": {"score": null, "vector": null}, "published": "2009-06-28T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : jasper (MDVSA-2009:142-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520", "CVE-2008-3521", "CVE-2008-3522"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:jasper", "p-cpe:/a:mandriva:linux:lib64jasper1", "p-cpe:/a:mandriva:linux:lib64jasper1-devel", "p-cpe:/a:mandriva:linux:lib64jasper1-static-devel", "p-cpe:/a:mandriva:linux:libjasper1", "p-cpe:/a:mandriva:linux:libjasper1-devel", "p-cpe:/a:mandriva:linux:libjasper1-static-devel", "cpe:/o:mandriva:linux:2008.0"], "id": "MANDRIVA_MDVSA-2009-142.NASL", "href": "https://www.tenable.com/plugins/nessus/39552", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2009:142. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(39552);\n script_version(\"1.17\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\", \"CVE-2008-3521\", \"CVE-2008-3522\");\n script_bugtraq_id(31470);\n script_xref(name:\"MDVSA\", value:\"2009:142-1\");\n\n script_name(english:\"Mandriva Linux Security Advisory : jasper (MDVSA-2009:142-1)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple security vulnerabilities has been identified and fixed in\njasper :\n\nThe jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer\nJPEG-2000 library (libjasper) before 1.900 allows remote user-assisted\nattackers to cause a denial of service (crash) and possibly corrupt\nthe heap via malformed image files, as originally demonstrated using\nimagemagick convert (CVE-2007-2721).\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nThe jas_stream_tmpfile function in libjasper/base/jas_stream.c in\nJasPer 1.900.1 allows local users to overwrite arbitrary files via a\nsymlink attack on a tmp.XXXXXXXXXX temporary file (CVE-2008-3521).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via vectors\nrelated to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nThe updated packages have been patched to prevent this.\n\nUpdate :\n\nPackages for 2008.0 are provided for Corporate Desktop 2008.0\ncustomers\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(59, 119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:jasper\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64jasper1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64jasper1-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64jasper1-static-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libjasper1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libjasper1-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libjasper1-static-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2008.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/12/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/06/28\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2008.0\", reference:\"jasper-1.900.1-2.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64jasper1-1.900.1-2.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64jasper1-devel-1.900.1-2.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64jasper1-static-devel-1.900.1-2.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libjasper1-1.900.1-2.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libjasper1-devel-1.900.1-2.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libjasper1-static-devel-1.900.1-2.1mdv2008.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:59:18", "description": "It was discovered that Ghostscript did not correctly handle memory allocation when parsing certain malformed JPEG-2000 images. If a user or automated system were tricked into opening a specially crafted image, an attacker could cause a denial of service and possibly execute arbitrary code with user privileges. (CVE-2008-3520)\n\nIt was discovered that Ghostscript did not correctly handle certain formatting operations when parsing JPEG-2000 images. If a user or automated system were tricked into opening a specially crafted image, an attacker could cause a denial of service and possibly execute arbitrary code with user privileges. (CVE-2008-3522)\n\nIt was discovered that Ghostscript incorrectly handled certain malformed TrueType fonts. If a user or automated system were tricked into opening a document containing a specially crafted font, an attacker could cause a denial of service and possibly execute arbitrary code with user privileges. This issue only affected Ubuntu 8.04 LTS. (CVE-2009-3743)\n\nIt was discovered that Ghostscript incorrectly handled certain malformed Type 2 fonts. If a user or automated system were tricked into opening a document containing a specially crafted font, an attacker could cause a denial of service and possibly execute arbitrary code with user privileges. This issue only affected Ubuntu 8.04 LTS. (CVE-2010-4054)\n\nJonathan Foote discovered that Ghostscript incorrectly handled certain malformed JPEG-2000 image files. If a user or automated system were tricked into opening a specially crafted JPEG-2000 image file, an attacker could cause Ghostscript to crash or possibly execute arbitrary code with user privileges. (CVE-2011-4516, CVE-2011-4517).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": null, "vector": null}, "published": "2012-01-05T00:00:00", "type": "nessus", "title": "Ubuntu 8.04 LTS / 10.04 LTS / 10.10 : ghostscript vulnerabilities (USN-1317-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522", "CVE-2009-3743", "CVE-2010-4054", "CVE-2011-4516", "CVE-2011-4517"], "modified": "2019-09-19T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:libgs8", "cpe:/o:canonical:ubuntu_linux:10.04:-:lts", "cpe:/o:canonical:ubuntu_linux:10.10", "cpe:/o:canonical:ubuntu_linux:8.04:-:lts"], "id": "UBUNTU_USN-1317-1.NASL", "href": "https://www.tenable.com/plugins/nessus/57436", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-1317-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(57436);\n script_version(\"1.14\");\n script_cvs_date(\"Date: 2019/09/19 12:54:27\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\", \"CVE-2009-3743\", \"CVE-2010-4054\", \"CVE-2011-4516\", \"CVE-2011-4517\");\n script_bugtraq_id(31470, 42640, 43932, 50992);\n script_xref(name:\"USN\", value:\"1317-1\");\n\n script_name(english:\"Ubuntu 8.04 LTS / 10.04 LTS / 10.10 : ghostscript vulnerabilities (USN-1317-1)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that Ghostscript did not correctly handle memory\nallocation when parsing certain malformed JPEG-2000 images. If a user\nor automated system were tricked into opening a specially crafted\nimage, an attacker could cause a denial of service and possibly\nexecute arbitrary code with user privileges. (CVE-2008-3520)\n\nIt was discovered that Ghostscript did not correctly handle certain\nformatting operations when parsing JPEG-2000 images. If a user or\nautomated system were tricked into opening a specially crafted image,\nan attacker could cause a denial of service and possibly execute\narbitrary code with user privileges. (CVE-2008-3522)\n\nIt was discovered that Ghostscript incorrectly handled certain\nmalformed TrueType fonts. If a user or automated system were tricked\ninto opening a document containing a specially crafted font, an\nattacker could cause a denial of service and possibly execute\narbitrary code with user privileges. This issue only affected Ubuntu\n8.04 LTS. (CVE-2009-3743)\n\nIt was discovered that Ghostscript incorrectly handled certain\nmalformed Type 2 fonts. If a user or automated system were tricked\ninto opening a document containing a specially crafted font, an\nattacker could cause a denial of service and possibly execute\narbitrary code with user privileges. This issue only affected Ubuntu\n8.04 LTS. (CVE-2010-4054)\n\nJonathan Foote discovered that Ghostscript incorrectly handled certain\nmalformed JPEG-2000 image files. If a user or automated system were\ntricked into opening a specially crafted JPEG-2000 image file, an\nattacker could cause Ghostscript to crash or possibly execute\narbitrary code with user privileges. (CVE-2011-4516, CVE-2011-4517).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/1317-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libgs8 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libgs8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:10.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:10.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:8.04:-:lts\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2008/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/01/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/01/05\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(8\\.04|10\\.04|10\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 8.04 / 10.04 / 10.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"8.04\", pkgname:\"libgs8\", pkgver:\"8.61.dfsg.1-1ubuntu3.4\")) flag++;\nif (ubuntu_check(osver:\"10.04\", pkgname:\"libgs8\", pkgver:\"8.71.dfsg.1-0ubuntu5.4\")) flag++;\nif (ubuntu_check(osver:\"10.10\", pkgname:\"libgs8\", pkgver:\"8.71.dfsg.2-0ubuntu7.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libgs8\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:09:00", "description": "Updated netpbm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.\n\nThis update has been rated as having moderate security impact by the Red Hat Security Response Team.\n\nThe netpbm package contains a library of functions for editing and converting between various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were discovered in the JasPer library providing support for JPEG-2000 image format and used in the jpeg2ktopam and pamtojpeg2k converters. An attacker could create a carefully-crafted JPEG file which could cause jpeg2ktopam to crash or, possibly, execute arbitrary code as the user running jpeg2ktopam. (CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which contain backported patches which resolve these issues.", "cvss3": {"score": null, "vector": null}, "published": "2009-02-12T00:00:00", "type": "nessus", "title": "RHEL 4 / 5 : netpbm (RHSA-2009:0012)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:netpbm", "p-cpe:/a:redhat:enterprise_linux:netpbm-devel", "p-cpe:/a:redhat:enterprise_linux:netpbm-progs", "cpe:/o:redhat:enterprise_linux:4", "cpe:/o:redhat:enterprise_linux:4.7", "cpe:/o:redhat:enterprise_linux:5", "cpe:/o:redhat:enterprise_linux:5.3"], "id": "REDHAT-RHSA-2009-0012.NASL", "href": "https://www.tenable.com/plugins/nessus/35652", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2009:0012. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(35652);\n script_version(\"1.26\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\");\n script_bugtraq_id(31470);\n script_xref(name:\"RHSA\", value:\"2009:0012\");\n\n script_name(english:\"RHEL 4 / 5 : netpbm (RHSA-2009:0012)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated netpbm packages that fix several security issues are now\navailable for Red Hat Enterprise Linux 4 and 5.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nThe netpbm package contains a library of functions for editing and\nconverting between various graphics file formats, including .pbm\n(portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps),\n.ppm (portable pixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were\ndiscovered in the JasPer library providing support for JPEG-2000 image\nformat and used in the jpeg2ktopam and pamtojpeg2k converters. An\nattacker could create a carefully-crafted JPEG file which could cause\njpeg2ktopam to crash or, possibly, execute arbitrary code as the user\nrunning jpeg2ktopam. (CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which\ncontain backported patches which resolve these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2007-2721\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2008-3520\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2009:0012\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected netpbm, netpbm-devel and / or netpbm-progs\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:netpbm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:netpbm-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:netpbm-progs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4.7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5.3\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/05/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/02/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/02/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(4|5)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 4.x / 5.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2009:0012\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL4\", reference:\"netpbm-10.25-2.1.el4_7.4\")) flag++;\n\n if (rpm_check(release:\"RHEL4\", reference:\"netpbm-devel-10.25-2.1.el4_7.4\")) flag++;\n\n if (rpm_check(release:\"RHEL4\", reference:\"netpbm-progs-10.25-2.1.el4_7.4\")) flag++;\n\n\n if (rpm_check(release:\"RHEL5\", reference:\"netpbm-10.35-6.1.el5_3.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", reference:\"netpbm-devel-10.35-6.1.el5_3.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"netpbm-progs-10.35-6.1.el5_3.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"netpbm-progs-10.35-6.1.el5_3.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"netpbm-progs-10.35-6.1.el5_3.1\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"netpbm / netpbm-devel / netpbm-progs\");\n }\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:09:00", "description": "Updated netpbm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.\n\nThis update has been rated as having moderate security impact by the Red Hat Security Response Team.\n\nThe netpbm package contains a library of functions for editing and converting between various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were discovered in the JasPer library providing support for JPEG-2000 image format and used in the jpeg2ktopam and pamtojpeg2k converters. An attacker could create a carefully-crafted JPEG file which could cause jpeg2ktopam to crash or, possibly, execute arbitrary code as the user running jpeg2ktopam. (CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which contain backported patches which resolve these issues.", "cvss3": {"score": null, "vector": null}, "published": "2009-02-12T00:00:00", "type": "nessus", "title": "CentOS 4 : netpbm (CESA-2009:0012)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:centos:centos:netpbm", "p-cpe:/a:centos:centos:netpbm-devel", "p-cpe:/a:centos:centos:netpbm-progs", "cpe:/o:centos:centos:4"], "id": "CENTOS_RHSA-2009-0012.NASL", "href": "https://www.tenable.com/plugins/nessus/35650", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2009:0012 and \n# CentOS Errata and Security Advisory 2009:0012 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(35650);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\");\n script_bugtraq_id(31470);\n script_xref(name:\"RHSA\", value:\"2009:0012\");\n\n script_name(english:\"CentOS 4 : netpbm (CESA-2009:0012)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated netpbm packages that fix several security issues are now\navailable for Red Hat Enterprise Linux 4 and 5.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nThe netpbm package contains a library of functions for editing and\nconverting between various graphics file formats, including .pbm\n(portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps),\n.ppm (portable pixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were\ndiscovered in the JasPer library providing support for JPEG-2000 image\nformat and used in the jpeg2ktopam and pamtojpeg2k converters. An\nattacker could create a carefully-crafted JPEG file which could cause\njpeg2ktopam to crash or, possibly, execute arbitrary code as the user\nrunning jpeg2ktopam. (CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which\ncontain backported patches which resolve these issues.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2009-February/015631.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?565ea68c\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2009-February/015632.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?17c8034b\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2009-February/015637.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e4821acd\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected netpbm packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:netpbm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:netpbm-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:netpbm-progs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/05/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/02/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/02/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^4([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 4.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"netpbm-10.25-2.1.el4.4\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"ia64\", reference:\"netpbm-10.25-2.1.c4.4\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"netpbm-10.25-2.1.el4.4\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"netpbm-devel-10.25-2.1.el4.4\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"ia64\", reference:\"netpbm-devel-10.25-2.1.c4.4\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"netpbm-devel-10.25-2.1.el4.4\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"netpbm-progs-10.25-2.1.el4.4\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"ia64\", reference:\"netpbm-progs-10.25-2.1.c4.4\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"netpbm-progs-10.25-2.1.el4.4\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"netpbm / netpbm-devel / netpbm-progs\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:57:24", "description": "An input validation flaw and multiple integer overflows were discovered in the JasPer library providing support for JPEG-2000 image format and used in the jpeg2ktopam and pamtojpeg2k converters. An attacker could create a carefully-crafted JPEG file which could cause jpeg2ktopam to crash or, possibly, execute arbitrary code as the user running jpeg2ktopam. (CVE-2007-2721, CVE-2008-3520)", "cvss3": {"score": null, "vector": null}, "published": "2012-08-01T00:00:00", "type": "nessus", "title": "Scientific Linux Security Update : netpbm on SL4.x, SL5.x i386/x86_64", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2021-01-14T00:00:00", "cpe": ["x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20090211_NETPBM_ON_SL4_X.NASL", "href": "https://www.tenable.com/plugins/nessus/60534", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(60534);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\");\n\n script_name(english:\"Scientific Linux Security Update : netpbm on SL4.x, SL5.x i386/x86_64\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Scientific Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An input validation flaw and multiple integer overflows were\ndiscovered in the JasPer library providing support for JPEG-2000 image\nformat and used in the jpeg2ktopam and pamtojpeg2k converters. An\nattacker could create a carefully-crafted JPEG file which could cause\njpeg2ktopam to crash or, possibly, execute arbitrary code as the user\nrunning jpeg2ktopam. (CVE-2007-2721, CVE-2008-3520)\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind0902&L=scientific-linux-errata&T=0&P=1130\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f647b0a3\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected netpbm, netpbm-devel and / or netpbm-progs\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_cwe_id(189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/02/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/08/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL4\", reference:\"netpbm-10.25-2.1.el4_7.4\")) flag++;\nif (rpm_check(release:\"SL4\", reference:\"netpbm-devel-10.25-2.1.el4_7.4\")) flag++;\nif (rpm_check(release:\"SL4\", reference:\"netpbm-progs-10.25-2.1.el4_7.4\")) flag++;\n\nif (rpm_check(release:\"SL5\", reference:\"netpbm-10.35-6.1.el5_3.1\")) flag++;\nif (rpm_check(release:\"SL5\", reference:\"netpbm-devel-10.35-6.1.el5_3.1\")) flag++;\nif (rpm_check(release:\"SL5\", reference:\"netpbm-progs-10.35-6.1.el5_3.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:54:23", "description": "From Red Hat Security Advisory 2009:0012 :\n\nUpdated netpbm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.\n\nThis update has been rated as having moderate security impact by the Red Hat Security Response Team.\n\nThe netpbm package contains a library of functions for editing and converting between various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were discovered in the JasPer library providing support for JPEG-2000 image format and used in the jpeg2ktopam and pamtojpeg2k converters. An attacker could create a carefully-crafted JPEG file which could cause jpeg2ktopam to crash or, possibly, execute arbitrary code as the user running jpeg2ktopam. (CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which contain backported patches which resolve these issues.", "cvss3": {"score": null, "vector": null}, "published": "2013-07-12T00:00:00", "type": "nessus", "title": "Oracle Linux 4 / 5 : netpbm (ELSA-2009-0012)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:netpbm", "p-cpe:/a:oracle:linux:netpbm-devel", "p-cpe:/a:oracle:linux:netpbm-progs", "cpe:/o:oracle:linux:4", "cpe:/o:oracle:linux:5"], "id": "ORACLELINUX_ELSA-2009-0012.NASL", "href": "https://www.tenable.com/plugins/nessus/67788", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2009:0012 and \n# Oracle Linux Security Advisory ELSA-2009-0012 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(67788);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-2721\", \"CVE-2008-3520\");\n script_bugtraq_id(31470);\n script_xref(name:\"RHSA\", value:\"2009:0012\");\n\n script_name(english:\"Oracle Linux 4 / 5 : netpbm (ELSA-2009-0012)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2009:0012 :\n\nUpdated netpbm packages that fix several security issues are now\navailable for Red Hat Enterprise Linux 4 and 5.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nThe netpbm package contains a library of functions for editing and\nconverting between various graphics file formats, including .pbm\n(portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps),\n.ppm (portable pixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were\ndiscovered in the JasPer library providing support for JPEG-2000 image\nformat and used in the jpeg2ktopam and pamtojpeg2k converters. An\nattacker could create a carefully-crafted JPEG file which could cause\njpeg2ktopam to crash or, possibly, execute arbitrary code as the user\nrunning jpeg2ktopam. (CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which\ncontain backported patches which resolve these issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2009-February/000887.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2009-February/000893.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected netpbm packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:ND/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:netpbm\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:netpbm-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:netpbm-progs\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:5\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/05/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/02/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/07/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(4|5)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 4 / 5\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL4\", reference:\"netpbm-10.25-2.1.el4_7.4\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"netpbm-devel-10.25-2.1.el4_7.4\")) flag++;\nif (rpm_check(release:\"EL4\", reference:\"netpbm-progs-10.25-2.1.el4_7.4\")) flag++;\n\nif (rpm_check(release:\"EL5\", reference:\"netpbm-10.35-6.1.el5_3.1\")) flag++;\nif (rpm_check(release:\"EL5\", reference:\"netpbm-devel-10.35-6.1.el5_3.1\")) flag++;\nif (rpm_check(release:\"EL5\", reference:\"netpbm-progs-10.35-6.1.el5_3.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"netpbm / netpbm-devel / netpbm-progs\");\n}\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:05:54", "description": "Multiple security vulnerabilities has been identified and fixed in ghostscript :\n\nA buffer underflow in Ghostscript's CCITTFax decoding filter allows remote attackers to cause denial of service and possibly to execute arbitrary by using a crafted PDF file (CVE-2007-6725).\n\nBuffer overflow in Ghostscript's BaseFont writer module allows remote attackers to cause a denial of service and possibly to execute arbitrary code via a crafted Postscript file (CVE-2008-6679).\n\nMultiple interger overflows in Ghostsript's International Color Consortium Format Library (icclib) allows attackers to cause denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code by using either a PostScript or PDF file with crafte embedded images (CVE-2009-0583, CVE-2009-0584).\n\nMultiple interger overflows in Ghostsript's International Color Consortium Format Library (icclib) allows attackers to cause denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code by using either a PostScript or PDF file with crafte embedded images. Note: this issue exists because of an incomplete fix for CVE-2009-0583 (CVE-2009-0792).\n\nHeap-based overflow in Ghostscript's JBIG2 decoding library allows attackers to cause denial of service and possibly to execute arbitrary code by using a crafted PDF file (CVE-2009-0196).\n\nMultiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation (CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (CVE-2008-3522).\n\nPreviousely the ghostscript packages were statically built against a bundled and private copy of the jasper library. This update makes ghostscript link against the shared system jasper library which makes it easier to address presumptive future security issues in the jasper library.\n\nPackages for 2008.0 are provided for Corporate Desktop 2008.0 customers\n\nThis update provides fixes for that vulnerabilities.", "cvss3": {"score": null, "vector": null}, "published": "2009-12-04T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : ghostscript (MDVSA-2009:311)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-6725", "CVE-2008-3520", "CVE-2008-3522", "CVE-2008-6679", "CVE-2009-0196", "CVE-2009-0583", "CVE-2009-0584", "CVE-2009-0792"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:ghostscript", "p-cpe:/a:mandriva:linux:ghostscript-X", "p-cpe:/a:mandriva:linux:ghostscript-common", "p-cpe:/a:mandriva:linux:ghostscript-doc", "p-cpe:/a:mandriva:linux:ghostscript-dvipdf", "p-cpe:/a:mandriva:linux:ghostscript-module-X", "p-cpe:/a:mandriva:linux:lib64gs8", "p-cpe:/a:mandriva:linux:lib64gs8-devel", "p-cpe:/a:mandriva:linux:lib64ijs1", "p-cpe:/a:mandriva:linux:lib64ijs1-devel", "p-cpe:/a:mandriva:linux:libgs8", "p-cpe:/a:mandriva:linux:libgs8-devel", "p-cpe:/a:mandriva:linux:libijs1", "p-cpe:/a:mandriva:linux:libijs1-devel", "cpe:/o:mandriva:linux:2008.0"], "id": "MANDRIVA_MDVSA-2009-311.NASL", "href": "https://www.tenable.com/plugins/nessus/42997", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2009:311. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(42997);\n script_version(\"1.19\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2007-6725\",\n \"CVE-2008-3520\",\n \"CVE-2008-3522\",\n \"CVE-2008-6679\",\n \"CVE-2009-0196\",\n \"CVE-2009-0583\",\n \"CVE-2009-0584\",\n \"CVE-2009-0792\"\n );\n script_bugtraq_id(\n 31470,\n 34184,\n 34337,\n 34340,\n 34445\n );\n script_xref(name:\"MDVSA\", value:\"2009:311\");\n\n script_name(english:\"Mandriva Linux Security Advisory : ghostscript (MDVSA-2009:311)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Multiple security vulnerabilities has been identified and fixed in\nghostscript :\n\nA buffer underflow in Ghostscript's CCITTFax decoding filter allows\nremote attackers to cause denial of service and possibly to execute\narbitrary by using a crafted PDF file (CVE-2007-6725).\n\nBuffer overflow in Ghostscript's BaseFont writer module allows remote\nattackers to cause a denial of service and possibly to execute\narbitrary code via a crafted Postscript file (CVE-2008-6679).\n\nMultiple interger overflows in Ghostsript's International Color\nConsortium Format Library (icclib) allows attackers to cause denial of\nservice (heap-based buffer overflow and application crash) and\npossibly execute arbitrary code by using either a PostScript or PDF\nfile with crafte embedded images (CVE-2009-0583, CVE-2009-0584).\n\nMultiple interger overflows in Ghostsript's International Color\nConsortium Format Library (icclib) allows attackers to cause denial of\nservice (heap-based buffer overflow and application crash) and\npossibly execute arbitrary code by using either a PostScript or PDF\nfile with crafte embedded images. Note: this issue exists because of\nan incomplete fix for CVE-2009-0583 (CVE-2009-0792).\n\nHeap-based overflow in Ghostscript's JBIG2 decoding library allows\nattackers to cause denial of service and possibly to execute arbitrary\ncode by using a crafted PDF file (CVE-2009-0196).\n\nMultiple integer overflows in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via a crafted\nimage file, related to integer multiplication for memory allocation\n(CVE-2008-3520).\n\nBuffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow\ncontext-dependent attackers to have an unknown impact via vectors\nrelated to the mif_hdr_put function and use of vsprintf\n(CVE-2008-3522).\n\nPreviousely the ghostscript packages were statically built against a\nbundled and private copy of the jasper library. This update makes\nghostscript link against the shared system jasper library which makes\nit easier to address presumptive future security issues in the jasper\nlibrary.\n\nPackages for 2008.0 are provided for Corporate Desktop 2008.0\ncustomers\n\nThis update provides fixes for that vulnerabilities.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript-X\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript-common\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript-dvipdf\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:ghostscript-module-X\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64gs8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64gs8-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64ijs1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64ijs1-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libgs8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libgs8-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libijs1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libijs1-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2008.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/12/03\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/12/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2008.0\", reference:\"ghostscript-8.60-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"ghostscript-X-8.60-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"ghostscript-common-8.60-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"ghostscript-doc-8.60-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"ghostscript-dvipdf-8.60-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"ghostscript-module-X-8.60-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64gs8-8.60-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64gs8-devel-8.60-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64ijs1-0.35-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"x86_64\", reference:\"lib64ijs1-devel-0.35-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libgs8-8.60-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libgs8-devel-8.60-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libijs1-0.35-55.3mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", cpu:\"i386\", reference:\"libijs1-devel-0.35-55.3mdv2008.0\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:44:16", "description": "New jasper packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.", "cvss3": {"score": null, "vector": null}, "published": "2015-10-30T00:00:00", "type": "nessus", "title": "Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : jasper (SSA:2015-302-02)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522", "CVE-2011-4516", "CVE-2011-4517", "CVE-2014-8137", "CVE-2014-8138", "CVE-2014-8157", "CVE-2014-8158", "CVE-2014-9029"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:slackware:slackware_linux:jasper", "cpe:/o:slackware:slackware_linux", "cpe:/o:slackware:slackware_linux:13.0", "cpe:/o:slackware:slackware_linux:13.1", "cpe:/o:slackware:slackware_linux:13.37", "cpe:/o:slackware:slackware_linux:14.0", "cpe:/o:slackware:slackware_linux:14.1"], "id": "SLACKWARE_SSA_2015-302-02.NASL", "href": "https://www.tenable.com/plugins/nessus/86663", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Slackware Security Advisory 2015-302-02. The text \n# itself is copyright (C) Slackware Linux, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(86663);\n script_version(\"2.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\", \"CVE-2011-4516\", \"CVE-2011-4517\", \"CVE-2014-8137\", \"CVE-2014-8138\", \"CVE-2014-8157\", \"CVE-2014-8158\", \"CVE-2014-9029\");\n script_xref(name:\"SSA\", value:\"2015-302-02\");\n\n script_name(english:\"Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : jasper (SSA:2015-302-02)\");\n script_summary(english:\"Checks for updated package in /var/log/packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Slackware host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"New jasper packages are available for Slackware 13.0, 13.1, 13.37,\n14.0, 14.1, and -current to fix security issues.\"\n );\n # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.538606\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?1595113f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected jasper package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:jasper\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:13.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:13.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:13.37\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:14.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2008/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/10/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/10/30\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Slackware Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Slackware/release\", \"Host/Slackware/packages\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"slackware.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Slackware/release\")) audit(AUDIT_OS_NOT, \"Slackware\");\nif (!get_kb_item(\"Host/Slackware/packages\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Slackware\", cpu);\n\n\nflag = 0;\nif (slackware_check(osver:\"13.0\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"i486\", pkgnum:\"3_slack13.0\")) flag++;\nif (slackware_check(osver:\"13.0\", arch:\"x86_64\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"x86_64\", pkgnum:\"3_slack13.0\")) flag++;\n\nif (slackware_check(osver:\"13.1\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"i486\", pkgnum:\"4_slack13.1\")) flag++;\nif (slackware_check(osver:\"13.1\", arch:\"x86_64\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"x86_64\", pkgnum:\"4_slack13.1\")) flag++;\n\nif (slackware_check(osver:\"13.37\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"i486\", pkgnum:\"4_slack13.37\")) flag++;\nif (slackware_check(osver:\"13.37\", arch:\"x86_64\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"x86_64\", pkgnum:\"4_slack13.37\")) flag++;\n\nif (slackware_check(osver:\"14.0\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"i486\", pkgnum:\"4_slack14.0\")) flag++;\nif (slackware_check(osver:\"14.0\", arch:\"x86_64\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"x86_64\", pkgnum:\"4_slack14.0\")) flag++;\n\nif (slackware_check(osver:\"14.1\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"i486\", pkgnum:\"4_slack14.1\")) flag++;\nif (slackware_check(osver:\"14.1\", arch:\"x86_64\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"x86_64\", pkgnum:\"4_slack14.1\")) flag++;\n\nif (slackware_check(osver:\"current\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"i586\", pkgnum:\"5\")) flag++;\nif (slackware_check(osver:\"current\", arch:\"x86_64\", pkgname:\"jasper\", pkgver:\"1.900.1\", pkgarch:\"x86_64\", pkgnum:\"5\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:slackware_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:46:25", "description": "Updated rhevm-spice-client packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Virtualization Manager 3.\n\nRed Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nRed Hat Enterprise Virtualization Manager provides access to virtual machines using SPICE. These SPICE client packages provide the SPICE client and usbclerk service for both Windows 32-bit operating systems and Windows 64-bit operating systems.\n\nThis update adds support for the TLS Fallback Signaling Cipher Suite Value (TLS_FALLBACK_SCSV), which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol version fails.\n\nThis can prevent a forceful downgrade of the communication to SSL 3.0.\nThe SSL 3.0 protocol was found to be vulnerable to the padding oracle attack when using block cipher suites in cipher block chaining (CBC) mode. This issue is identified as CVE-2014-3566, and also known under the alias POODLE. This SSL 3.0 protocol flaw will not be addressed in a future update; it is recommended that users configure their applications to require at least TLS protocol version 1.0 for secure communication.\n\nFor additional information about this flaw, see the Knowledgebase article at https://access.redhat.com/articles/1232123\n\nMultiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8138, CVE-2014-8157, CVE-2014-8158, CVE-2014-9029, CVE-2014-8137, CVE-2011-4516, CVE-2011-4517, CVE-2008-3520, CVE-2008-3522)\n\nRed Hat would like to thank oCERT for reporting CVE-2014-8137, CVE-2014-8138, CVE-2014-8157, CVE-2014-8158, CVE-2014-9029, CVE-2011-4516, and CVE-2011-4517. oCERT acknowledges Jose Duart of the Google Security Team as the original reporter of CVE-2014-8137 and CVE-2014-8138; and pyddeh as the original reporter of CVE-2014-8157 and CVE-2014-8158.\n\nThe mingw-openssl and mingw-jasper packages have been upgraded to the latest upstream version, which provides a number of bug fixes and enhancements over the previous version. (BZ#1187585)\n\nThis update also fixes the following bugs :\n\n* Previously, a guest system installed with tools incorrectly always started in full screen mode, even when the 'Open in Full Screen' option was unchecked in console options. Now, when connecting in window mode with the option unchecked, the guest system starts in a window as expected. (BZ#1172126)\n\n* Prior to this update, copying and pasting of images from the client to the guest did not work when spice-gtk was built from upstream. Now, images can be copied and pasted without problems. (BZ#1187270)\n\nIn addition, this update adds the following enhancement :\n\n* Administrators now have the option of automatic multiuser installation of virt-viewer onto many client workstations.\n(BZ#1187272)\n\nAll rhevm-spice-client users are advised to upgrade to these updated packages, which correct these issues and add these enhancement.", "cvss3": {"score": 3.4, "vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N"}, "published": "2015-03-20T00:00:00", "type": "nessus", "title": "RHEL 6 : rhevm-spice-client (RHSA-2015:0698) (POODLE)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522", "CVE-2011-4516", "CVE-2011-4517", "CVE-2014-3566", "CVE-2014-8137", "CVE-2014-8138", "CVE-2014-8157", "CVE-2014-8158", "CVE-2014-9029"], "modified": "2019-11-12T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:rhevm-spice-client-x64-cab", "p-cpe:/a:redhat:enterprise_linux:rhevm-spice-client-x64-msi", "p-cpe:/a:redhat:enterprise_linux:rhevm-spice-client-x86-cab", "p-cpe:/a:redhat:enterprise_linux:rhevm-spice-client-x86-msi", "cpe:/o:redhat:enterprise_linux:6"], "id": "REDHAT-RHSA-2015-0698.NASL", "href": "https://www.tenable.com/plugins/nessus/81969", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2015:0698. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(81969);\n script_version(\"1.22\");\n script_cvs_date(\"Date: 2019/11/12\");\n\n script_cve_id(\"CVE-2008-3520\", \"CVE-2008-3522\", \"CVE-2011-4516\", \"CVE-2011-4517\", \"CVE-2014-3566\", \"CVE-2014-8137\", \"CVE-2014-8138\", \"CVE-2014-8157\", \"CVE-2014-8158\", \"CVE-2014-9029\");\n script_xref(name:\"RHSA\", value:\"2015:0698\");\n\n script_name(english:\"RHEL 6 : rhevm-spice-client (RHSA-2015:0698) (POODLE)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated rhevm-spice-client packages that fix multiple security issues,\nseveral bugs, and add one enhancement are now available for Red Hat\nEnterprise Virtualization Manager 3.\n\nRed Hat Product Security has rated this update as having Important\nsecurity impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.\n\nRed Hat Enterprise Virtualization Manager provides access to virtual\nmachines using SPICE. These SPICE client packages provide the SPICE\nclient and usbclerk service for both Windows 32-bit operating systems\nand Windows 64-bit operating systems.\n\nThis update adds support for the TLS Fallback Signaling Cipher Suite\nValue (TLS_FALLBACK_SCSV), which can be used to prevent protocol\ndowngrade attacks against applications which re-connect using a lower\nSSL/TLS protocol version when the initial connection indicating the\nhighest supported protocol version fails.\n\nThis can prevent a forceful downgrade of the communication to SSL 3.0.\nThe SSL 3.0 protocol was found to be vulnerable to the padding oracle\nattack when using block cipher suites in cipher block chaining (CBC)\nmode. This issue is identified as CVE-2014-3566, and also known under\nthe alias POODLE. This SSL 3.0 protocol flaw will not be addressed in\na future update; it is recommended that users configure their\napplications to require at least TLS protocol version 1.0 for secure\ncommunication.\n\nFor additional information about this flaw, see the Knowledgebase\narticle at https://access.redhat.com/articles/1232123\n\nMultiple flaws were found in the way JasPer decoded JPEG 2000 image\nfiles. A specially crafted file could cause an application using\nJasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8138,\nCVE-2014-8157, CVE-2014-8158, CVE-2014-9029, CVE-2014-8137,\nCVE-2011-4516, CVE-2011-4517, CVE-2008-3520, CVE-2008-3522)\n\nRed Hat would like to thank oCERT for reporting CVE-2014-8137,\nCVE-2014-8138, CVE-2014-8157, CVE-2014-8158, CVE-2014-9029,\nCVE-2011-4516, and CVE-2011-4517. oCERT acknowledges Jose Duart of the\nGoogle Security Team as the original reporter of CVE-2014-8137 and\nCVE-2014-8138; and pyddeh as the original reporter of CVE-2014-8157\nand CVE-2014-8158.\n\nThe mingw-openssl and mingw-jasper packages have been upgraded to the\nlatest upstream version, which provides a number of bug fixes and\nenhancements over the previous version. (BZ#1187585)\n\nThis update also fixes the following bugs :\n\n* Previously, a guest system installed with tools incorrectly always\nstarted in full screen mode, even when the 'Open in Full Screen'\noption was unchecked in console options. Now, when connecting in\nwindow mode with the option unchecked, the guest system starts in a\nwindow as expected. (BZ#1172126)\n\n* Prior to this update, copying and pasting of images from the client\nto the guest did not work when spice-gtk was built from upstream. Now,\nimages can be copied and pasted without problems. (BZ#1187270)\n\nIn addition, this update adds the following enhancement :\n\n* Administrators now have the option of automatic multiuser\ninstallation of virt-viewer onto many client workstations.\n(BZ#1187272)\n\nAll rhevm-spice-client users are advised to upgrade to these updated\npackages, which correct these issues and add these enhancement.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2015:0698\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2008-3520\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2008-3522\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2011-4516\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2011-4517\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-8137\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-8138\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-8157\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-8158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2014-9029\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rhevm-spice-client-x64-cab\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rhevm-spice-client-x64-msi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rhevm-spice-client-x86-cab\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:rhevm-spice-client-x86-msi\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:6\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2008/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2015/03/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2015/03/20\");\n script_set_attribute(attribute:\"in_the_news\", value:\"true\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 6.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2015:0698\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_exists(rpm:\"rhevm-spice-client-x64-cab-3.5-\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", reference:\"rhevm-spice-client-x64-cab-3.5-3.el6\")) flag++;\n if (rpm_exists(rpm:\"rhevm-spice-client-x64-msi-3.5-\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", reference:\"rhevm-spice-client-x64-msi-3.5-3.el6\")) flag++;\n if (rpm_exists(rpm:\"rhevm-spice-client-x86-cab-3.5-\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", reference:\"rhevm-spice-client-x86-cab-3.5-3.el6\")) flag++;\n if (rpm_exists(rpm:\"rhevm-spice-client-x86-msi-3.5-\", release:\"RHEL6\") && rpm_check(release:\"RHEL6\", reference:\"rhevm-spice-client-x86-msi-3.5-3.el6\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"rhevm-spice-client-x64-cab / rhevm-spice-client-x64-msi / etc\");\n }\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T13:03:38", "description": "Several security issues have been discovered in Ghostscript, a GPL PostScript/PDF interpreter, which might lead to the execution of arbitrary code if a user processes a malformed PDF or Postscript file.", "cvss3": {"score": null, "vector": null}, "published": "2010-08-03T00:00:00", "type": "nessus", "title": "Debian DSA-2080-1 : ghostscript - several vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-6725", "CVE-2008-3522", "CVE-2008-6679", "CVE-2009-0196", "CVE-2009-0792", "CVE-2009-4270", "CVE-2010-1869"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:ghostscript", "cpe:/o:debian:debian_linux:5.0"], "id": "DEBIAN_DSA-2080.NASL", "href": "https://www.tenable.com/plugins/nessus/48223", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-2080. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(48223);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2007-6725\", \"CVE-2008-3522\", \"CVE-2008-6679\", \"CVE-2009-0196\", \"CVE-2009-0792\", \"CVE-2009-4270\", \"CVE-2010-1869\");\n script_bugtraq_id(31470, 34184, 34337, 34340, 34445, 37410, 40103);\n script_xref(name:\"DSA\", value:\"2080\");\n\n script_name(english:\"Debian DSA-2080-1 : ghostscript - several vulnerabilities\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several security issues have been discovered in Ghostscript, a GPL\nPostScript/PDF interpreter, which might lead to the execution of\narbitrary code if a user processes a malformed PDF or Postscript file.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2010/dsa-2080\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the ghostscript packages.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 8.62.dfsg.1-3.2lenny4.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(119, 189);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:ghostscript\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:5.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2010/08/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2010/08/03\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2010-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"5.0\", prefix:\"ghostscript\", reference:\"8.62.dfsg.1-3.2lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"ghostscript-doc\", reference:\"8.62.dfsg.1-3.2lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"ghostscript-x\", reference:\"8.62.dfsg.1-3.2lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"gs\", reference:\"8.62.dfsg.1-3.2lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"gs-aladdin\", reference:\"8.62.dfsg.1-3.2lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"gs-common\", reference:\"8.62.dfsg.1-3.2lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"gs-esp\", reference:\"8.62.dfsg.1-3.2lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"gs-gpl\", reference:\"8.62.dfsg.1-3.2lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"libgs-dev\", reference:\"8.62.dfsg.1-3.2lenny4\")) flag++;\nif (deb_check(release:\"5.0\", prefix:\"libgs8\", reference:\"8.62.dfsg.1-3.2lenny4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:39:44", "description": "This update for jasper to version 1.900.14 fixes several issues.\n\nThese security issues were fixed :\n\n - CVE-2008-3522: Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer might have allowed context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (bsc#392410)\n\n - CVE-2015-5203: Double free corruption in JasPer JPEG-2000 implementation (bsc#941919).\n\n - CVE-2015-5221: Use-after-free (and double-free) in Jasper JPEG-200 (bsc#942553).\n\n - CVE-2016-1577: Double free vulnerability in the jas_iccattrval_destroy function in JasPer allowed remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137 (bsc#968373).\n\n - CVE-2016-2116: Memory leak in the jas_iccprof_createfrombuf function in JasPer allowed remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file (bsc#968373)\n\n - CVE-2016-8690: NULL pointer dereference in bmp_getdata triggered by crafted BMP image (bsc#1005084).\n\n - CVE-2016-8691, CVE-2016-8692: Missing range check on XRsiz and YRsiz fields of SIZ marker segment (bsc#1005090).\n\n - CVE-2016-8693: The memory stream interface allowed for a buffer size of zero. The case of a zero-sized buffer was not handled correctly, as it could lead to a double free (bsc#1005242).\n\n - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox() (bsc#1006591).\n\n - CVE-2016-8881: Heap overflow in jpc_getuint16() (bsc#1006593).\n\n - CVE-2016-8882: NULL pointer access in jpc_pi_destroy (bsc#1006597).\n\n - CVE-2016-8883: Assert triggered in jpc_dec_tiledecode() (bsc#1006598).\n\n - CVE-2016-8886: Memory allocation failure in jas_malloc (jas_malloc.c) (bsc#1006599).\n\nFor additional change description please have a look at the changelog.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2016-11-07T00:00:00", "type": "nessus", "title": "openSUSE Security Update : jasper (openSUSE-2016-1263)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2014-8137", "CVE-2015-5203", "CVE-2015-5221", "CVE-2016-1577", "CVE-2016-2116", "CVE-2016-8690", "CVE-2016-8691", "CVE-2016-8692", "CVE-2016-8693", "CVE-2016-8880", "CVE-2016-8881", "CVE-2016-8882", "CVE-2016-8883", "CVE-2016-8886"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:jasper", "p-cpe:/a:novell:opensuse:jasper-debuginfo", "p-cpe:/a:novell:opensuse:jasper-debugsource", "p-cpe:/a:novell:opensuse:libjasper-devel", "p-cpe:/a:novell:opensuse:libjasper1", "p-cpe:/a:novell:opensuse:libjasper1-32bit", "p-cpe:/a:novell:opensuse:libjasper1-debuginfo", "p-cpe:/a:novell:opensuse:libjasper1-debuginfo-32bit", "cpe:/o:novell:opensuse:13.2"], "id": "OPENSUSE-2016-1263.NASL", "href": "https://www.tenable.com/plugins/nessus/94596", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-1263.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(94596);\n script_version(\"2.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2008-3522\", \"CVE-2014-8137\", \"CVE-2015-5203\", \"CVE-2015-5221\", \"CVE-2016-1577\", \"CVE-2016-2116\", \"CVE-2016-8690\", \"CVE-2016-8691\", \"CVE-2016-8692\", \"CVE-2016-8693\", \"CVE-2016-8880\", \"CVE-2016-8881\", \"CVE-2016-8882\", \"CVE-2016-8883\", \"CVE-2016-8886\");\n\n script_name(english:\"openSUSE Security Update : jasper (openSUSE-2016-1263)\");\n script_summary(english:\"Check for the openSUSE-2016-1263 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for jasper to version 1.900.14 fixes several issues.\n\nThese security issues were fixed :\n\n - CVE-2008-3522: Buffer overflow in the jas_stream_printf\n function in libjasper/base/jas_stream.c in JasPer might\n have allowed context-dependent attackers to have an\n unknown impact via vectors related to the mif_hdr_put\n function and use of vsprintf (bsc#392410)\n\n - CVE-2015-5203: Double free corruption in JasPer\n JPEG-2000 implementation (bsc#941919).\n\n - CVE-2015-5221: Use-after-free (and double-free) in\n Jasper JPEG-200 (bsc#942553).\n\n - CVE-2016-1577: Double free vulnerability in the\n jas_iccattrval_destroy function in JasPer allowed remote\n attackers to cause a denial of service (crash) or\n possibly execute arbitrary code via a crafted ICC color\n profile in a JPEG 2000 image file, a different\n vulnerability than CVE-2014-8137 (bsc#968373).\n\n - CVE-2016-2116: Memory leak in the\n jas_iccprof_createfrombuf function in JasPer allowed\n remote attackers to cause a denial of service (memory\n consumption) via a crafted ICC color profile in a JPEG\n 2000 image file (bsc#968373)\n\n - CVE-2016-8690: NULL pointer dereference in bmp_getdata\n triggered by crafted BMP image (bsc#1005084).\n\n - CVE-2016-8691, CVE-2016-8692: Missing range check on\n XRsiz and YRsiz fields of SIZ marker segment\n (bsc#1005090).\n\n - CVE-2016-8693: The memory stream interface allowed for a\n buffer size of zero. The case of a zero-sized buffer was\n not handled correctly, as it could lead to a double free\n (bsc#1005242).\n\n - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox()\n (bsc#1006591).\n\n - CVE-2016-8881: Heap overflow in jpc_getuint16()\n (bsc#1006593).\n\n - CVE-2016-8882: NULL pointer access in jpc_pi_destroy\n (bsc#1006597).\n\n - CVE-2016-8883: Assert triggered in jpc_dec_tiledecode()\n (bsc#1006598).\n\n - CVE-2016-8886: Memory allocation failure in jas_malloc\n (jas_malloc.c) (bsc#1006599).\n\nFor additional change description please have a look at the changelog.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1005084\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1005090\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1005242\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006591\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006593\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006597\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006598\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006599\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=392410\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=941919\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=942553\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=968373\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected jasper packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:jasper\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:jasper-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:jasper-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/11/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/11/07\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.2\", reference:\"jasper-1.900.14-163.24.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"jasper-debuginfo-1.900.14-163.24.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"jasper-debugsource-1.900.14-163.24.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libjasper-devel-1.900.14-163.24.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libjasper1-1.900.14-163.24.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", reference:\"libjasper1-debuginfo-1.900.14-163.24.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"libjasper1-32bit-1.900.14-163.24.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.2\", cpu:\"x86_64\", reference:\"libjasper1-debuginfo-32bit-1.900.14-163.24.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jasper / jasper-debuginfo / jasper-debugsource / libjasper-devel / etc\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:39:29", "description": "This update for jasper fixes the following issues: Security fixes :\n\n - CVE-2016-8887: NULL pointer dereference in jp2_colr_destroy (jp2_cod.c) (bsc#1006836)\n\n - CVE-2016-8886: memory allocation failure in jas_malloc (jas_malloc.c) (bsc#1006599)\n\n - CVE-2016-8884,CVE-2016-8885: two NULL pointer dereferences in bmp_getdata (incomplete fix for CVE-2016-8690) (bsc#1007009)\n\n - CVE-2016-8883: assert in jpc_dec_tiledecode() (bsc#1006598)\n\n - CVE-2016-8882: segfault / NULL pointer access in jpc_pi_destroy (bsc#1006597)\n\n - CVE-2016-8881: Heap overflow in jpc_getuint16() (bsc#1006593)\n\n - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox() (bsc#1006591)\n\n - CVE-2016-8693: Double free vulnerability in mem_close (bsc#1005242)\n\n - CVE-2016-8691, CVE-2016-8692: Divide by zero in jpc_dec_process_siz (bsc#1005090)\n\n - CVE-2016-8690: NULL pointer dereference in bmp_getdata triggered by crafted BMP image (bsc#1005084)\n\n - CVE-2016-2089: invalid read in the JasPer's jas_matrix_clip() function (bsc#963983)\n\n - CVE-2016-1867: Out-of-bounds Read in the JasPer's jpc_pi_nextcprl() function (bsc#961886)\n\n - CVE-2016-1577, CVE-2016-2116: double free vulnerability in the jas_iccattrval_destroy function (bsc#968373)\n\n - CVE-2015-5221: Use-after-free (and double-free) in Jasper JPEG-200 (bsc#942553)\n\n - CVE-2015-5203: Double free corruption in JasPer JPEG-2000 implementation (bsc#941919)\n\n - CVE-2008-3522: multiple integer overflows (bsc#392410)\n\n - bsc#1006839: NULL pointer dereference in jp2_colr_destroy (jp2_cod.c) (incomplete fix for CVE-2016-8887)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2016-11-11T00:00:00", "type": "nessus", "title": "SUSE SLES11 Security Update : jasper (SUSE-SU-2016:2776-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2015-5203", "CVE-2015-5221", "CVE-2016-1577", "CVE-2016-1867", "CVE-2016-2089", "CVE-2016-2116", "CVE-2016-8690", "CVE-2016-8691", "CVE-2016-8692", "CVE-2016-8693", "CVE-2016-8880", "CVE-2016-8881", "CVE-2016-8882", "CVE-2016-8883", "CVE-2016-8884", "CVE-2016-8885", "CVE-2016-8886", "CVE-2016-8887"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:libjasper", "cpe:/o:novell:suse_linux:11"], "id": "SUSE_SU-2016-2776-1.NASL", "href": "https://www.tenable.com/plugins/nessus/94729", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:2776-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(94729);\n script_version(\"2.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2008-3522\", \"CVE-2015-5203\", \"CVE-2015-5221\", \"CVE-2016-1577\", \"CVE-2016-1867\", \"CVE-2016-2089\", \"CVE-2016-2116\", \"CVE-2016-8690\", \"CVE-2016-8691\", \"CVE-2016-8692\", \"CVE-2016-8693\", \"CVE-2016-8880\", \"CVE-2016-8881\", \"CVE-2016-8882\", \"CVE-2016-8883\", \"CVE-2016-8884\", \"CVE-2016-8885\", \"CVE-2016-8886\", \"CVE-2016-8887\");\n script_bugtraq_id(31470);\n\n script_name(english:\"SUSE SLES11 Security Update : jasper (SUSE-SU-2016:2776-1)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for jasper fixes the following issues: Security fixes :\n\n - CVE-2016-8887: NULL pointer dereference in\n jp2_colr_destroy (jp2_cod.c) (bsc#1006836)\n\n - CVE-2016-8886: memory allocation failure in jas_malloc\n (jas_malloc.c) (bsc#1006599)\n\n - CVE-2016-8884,CVE-2016-8885: two NULL pointer\n dereferences in bmp_getdata (incomplete fix for\n CVE-2016-8690) (bsc#1007009)\n\n - CVE-2016-8883: assert in jpc_dec_tiledecode()\n (bsc#1006598)\n\n - CVE-2016-8882: segfault / NULL pointer access in\n jpc_pi_destroy (bsc#1006597)\n\n - CVE-2016-8881: Heap overflow in jpc_getuint16()\n (bsc#1006593)\n\n - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox()\n (bsc#1006591)\n\n - CVE-2016-8693: Double free vulnerability in mem_close\n (bsc#1005242)\n\n - CVE-2016-8691, CVE-2016-8692: Divide by zero in\n jpc_dec_process_siz (bsc#1005090)\n\n - CVE-2016-8690: NULL pointer dereference in bmp_getdata\n triggered by crafted BMP image (bsc#1005084)\n\n - CVE-2016-2089: invalid read in the JasPer's\n jas_matrix_clip() function (bsc#963983)\n\n - CVE-2016-1867: Out-of-bounds Read in the JasPer's\n jpc_pi_nextcprl() function (bsc#961886)\n\n - CVE-2016-1577, CVE-2016-2116: double free vulnerability\n in the jas_iccattrval_destroy function (bsc#968373)\n\n - CVE-2015-5221: Use-after-free (and double-free) in\n Jasper JPEG-200 (bsc#942553)\n\n - CVE-2015-5203: Double free corruption in JasPer\n JPEG-2000 implementation (bsc#941919)\n\n - CVE-2008-3522: multiple integer overflows (bsc#392410)\n\n - bsc#1006839: NULL pointer dereference in\n jp2_colr_destroy (jp2_cod.c) (incomplete fix for\n CVE-2016-8887)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1005084\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1005090\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1005242\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006591\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006593\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006597\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006598\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006599\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006836\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006839\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1007009\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=392410\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=941919\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=942553\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961886\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963983\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=968373\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2008-3522/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5203/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5221/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1577/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1867/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2089/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2116/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8690/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8691/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8692/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8693/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8880/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8881/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8882/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8883/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8884/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8885/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8886/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8887/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20162776-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?730c3414\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 11-SP4:zypper in -t\npatch sdksp4-jasper-12846=1\n\nSUSE Linux Enterprise Server 11-SP4:zypper in -t patch\nslessp4-jasper-12846=1\n\nSUSE Linux Enterprise Debuginfo 11-SP4:zypper in -t patch\ndbgsp4-jasper-12846=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjasper\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2008/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/11/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/11/11\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"libjasper-32bit-1.900.14-134.25.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"s390x\", reference:\"libjasper-32bit-1.900.14-134.25.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"libjasper-1.900.14-134.25.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jasper\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:39:06", "description": "This update for jasper to version 1.900.14 fixes several issues.\n\nThese security issues were fixed :\n\n - CVE-2016-8887: NULL pointer dereference in jp2_colr_destroy (jp2_cod.c) (bsc#1006836)\n\n - CVE-2016-8886: memory allocation failure in jas_malloc (jas_malloc.c) (bsc#1006599)\n\n - CVE-2016-8884,CVE-2016-8885: two NULL pointer dereferences in bmp_getdata (incomplete fix for CVE-2016-8690) (bsc#1007009)\n\n - CVE-2016-8883: assert in jpc_dec_tiledecode() (bsc#1006598)\n\n - CVE-2016-8882: segfault / NULL pointer access in jpc_pi_destroy (bsc#1006597)\n\n - CVE-2016-8881: Heap overflow in jpc_getuint16() (bsc#1006593)\n\n - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox() (bsc#1006591)\n\n - CVE-2016-8693 Double free vulnerability in mem_close (bsc#1005242)\n\n - CVE-2016-8691, CVE-2016-8692: Divide by zero in jpc_dec_process_siz (bsc#1005090)\n\n - CVE-2016-8690: NULL pointer dereference in bmp_getdata triggered by crafted BMP image (bsc#1005084)\n\n - CVE-2016-2116: Memory leak in the jas_iccprof_createfrombuf function in JasPer allowed remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file (bsc#968373) \n\n - CVE-2016-2089: invalid read in the JasPer's jas_matrix_clip() function (bsc#963983)\n\n - CVE-2016-1867: Out-of-bounds Read in the JasPer's jpc_pi_nextcprl() function (bsc#961886)\n\n - CVE-2015-5221: Use-after-free (and double-free) in Jasper JPEG-200 (bsc#942553).\n\n - CVE-2015-5203: Double free corruption in JasPer JPEG-2000 implementation (bsc#941919)\n\n - CVE-2008-3522: Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer might have allowed context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (bsc#392410)\n\n - jasper: NULL pointer dereference in jp2_colr_destroy (jp2_cod.c) (incomplete fix for CVE-2016-8887) (bsc#1006839)\n\nFor additional change description please have a look at the changelog.\n\nThis update was imported from the SUSE:SLE-12:Update update project.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2016-11-18T00:00:00", "type": "nessus", "title": "openSUSE Security Update : jasper (openSUSE-2016-1309)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2014-8158", "CVE-2015-5203", "CVE-2015-5221", "CVE-2016-1577", "CVE-2016-1867", "CVE-2016-2089", "CVE-2016-2116", "CVE-2016-8690", "CVE-2016-8691", "CVE-2016-8692", "CVE-2016-8693", "CVE-2016-8880", "CVE-2016-8881", "CVE-2016-8882", "CVE-2016-8883", "CVE-2016-8884", "CVE-2016-8885", "CVE-2016-8886", "CVE-2016-8887"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:jasper", "p-cpe:/a:novell:opensuse:jasper-debuginfo", "p-cpe:/a:novell:opensuse:jasper-debugsource", "p-cpe:/a:novell:opensuse:libjasper-devel", "p-cpe:/a:novell:opensuse:libjasper1", "p-cpe:/a:novell:opensuse:libjasper1-32bit", "p-cpe:/a:novell:opensuse:libjasper1-debuginfo", "p-cpe:/a:novell:opensuse:libjasper1-debuginfo-32bit", "cpe:/o:novell:opensuse:42.1", "cpe:/o:novell:opensuse:42.2"], "id": "OPENSUSE-2016-1309.NASL", "href": "https://www.tenable.com/plugins/nessus/94945", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-1309.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(94945);\n script_version(\"2.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2008-3522\", \"CVE-2014-8158\", \"CVE-2015-5203\", \"CVE-2015-5221\", \"CVE-2016-1577\", \"CVE-2016-1867\", \"CVE-2016-2089\", \"CVE-2016-2116\", \"CVE-2016-8690\", \"CVE-2016-8691\", \"CVE-2016-8692\", \"CVE-2016-8693\", \"CVE-2016-8880\", \"CVE-2016-8881\", \"CVE-2016-8882\", \"CVE-2016-8883\", \"CVE-2016-8884\", \"CVE-2016-8885\", \"CVE-2016-8886\", \"CVE-2016-8887\");\n\n script_name(english:\"openSUSE Security Update : jasper (openSUSE-2016-1309)\");\n script_summary(english:\"Check for the openSUSE-2016-1309 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for jasper to version 1.900.14 fixes several issues.\n\nThese security issues were fixed :\n\n - CVE-2016-8887: NULL pointer dereference in\n jp2_colr_destroy (jp2_cod.c) (bsc#1006836)\n\n - CVE-2016-8886: memory allocation failure in jas_malloc\n (jas_malloc.c) (bsc#1006599)\n\n - CVE-2016-8884,CVE-2016-8885: two NULL pointer\n dereferences in bmp_getdata (incomplete fix for\n CVE-2016-8690) (bsc#1007009)\n\n - CVE-2016-8883: assert in jpc_dec_tiledecode()\n (bsc#1006598)\n\n - CVE-2016-8882: segfault / NULL pointer access in\n jpc_pi_destroy (bsc#1006597)\n\n - CVE-2016-8881: Heap overflow in jpc_getuint16()\n (bsc#1006593)\n\n - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox()\n (bsc#1006591)\n\n - CVE-2016-8693 Double free vulnerability in mem_close\n (bsc#1005242)\n\n - CVE-2016-8691, CVE-2016-8692: Divide by zero in\n jpc_dec_process_siz (bsc#1005090)\n\n - CVE-2016-8690: NULL pointer dereference in bmp_getdata\n triggered by crafted BMP image (bsc#1005084)\n\n - CVE-2016-2116: Memory leak in the\n jas_iccprof_createfrombuf function in JasPer allowed\n remote attackers to cause a denial of service (memory\n consumption) via a crafted ICC color profile in a JPEG\n 2000 image file (bsc#968373) \n\n - CVE-2016-2089: invalid read in the JasPer's\n jas_matrix_clip() function (bsc#963983)\n\n - CVE-2016-1867: Out-of-bounds Read in the JasPer's\n jpc_pi_nextcprl() function (bsc#961886)\n\n - CVE-2015-5221: Use-after-free (and double-free) in\n Jasper JPEG-200 (bsc#942553).\n\n - CVE-2015-5203: Double free corruption in JasPer\n JPEG-2000 implementation (bsc#941919)\n\n - CVE-2008-3522: Buffer overflow in the jas_stream_printf\n function in libjasper/base/jas_stream.c in JasPer might\n have allowed context-dependent attackers to have an\n unknown impact via vectors related to the mif_hdr_put\n function and use of vsprintf (bsc#392410)\n\n - jasper: NULL pointer dereference in jp2_colr_destroy\n (jp2_cod.c) (incomplete fix for CVE-2016-8887)\n (bsc#1006839)\n\nFor additional change description please have a look at the changelog.\n\nThis update was imported from the SUSE:SLE-12:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1005084\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1005090\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1005242\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006591\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006593\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006597\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006598\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006599\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006836\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006839\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007009\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=392410\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=941919\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=942553\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=961886\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=963983\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=968373\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected jasper packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:jasper\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:jasper-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:jasper-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.2\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/11/17\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/11/18\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.1|SUSE42\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.1 / 42.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.1\", reference:\"jasper-1.900.14-166.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"jasper-debuginfo-1.900.14-166.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"jasper-debugsource-1.900.14-166.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"libjasper-devel-1.900.14-166.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"libjasper1-1.900.14-166.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", reference:\"libjasper1-debuginfo-1.900.14-166.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"libjasper1-32bit-1.900.14-166.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.1\", cpu:\"x86_64\", reference:\"libjasper1-debuginfo-32bit-1.900.14-166.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"jasper-1.900.14-167.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"jasper-debuginfo-1.900.14-167.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"jasper-debugsource-1.900.14-167.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libjasper-devel-1.900.14-167.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libjasper1-1.900.14-167.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libjasper1-debuginfo-1.900.14-167.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", cpu:\"x86_64\", reference:\"libjasper1-32bit-1.900.14-167.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", cpu:\"x86_64\", reference:\"libjasper1-debuginfo-32bit-1.900.14-167.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jasper / jasper-debuginfo / jasper-debugsource / libjasper-devel / etc\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:39:36", "description": "This update for jasper to version 1.900.14 fixes several issues. These security issues were fixed :\n\n - CVE-2016-8887: NULL pointer dereference in jp2_colr_destroy (jp2_cod.c) (bsc#1006836)\n\n - CVE-2016-8886: memory allocation failure in jas_malloc (jas_malloc.c) (bsc#1006599)\n\n - CVE-2016-8884,CVE-2016-8885: two NULL pointer dereferences in bmp_getdata (incomplete fix for CVE-2016-8690) (bsc#1007009)\n\n - CVE-2016-8883: assert in jpc_dec_tiledecode() (bsc#1006598)\n\n - CVE-2016-8882: segfault / NULL pointer access in jpc_pi_destroy (bsc#1006597)\n\n - CVE-2016-8881: Heap overflow in jpc_getuint16() (bsc#1006593)\n\n - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox() (bsc#1006591)\n\n - CVE-2016-8693 Double free vulnerability in mem_close (bsc#1005242)\n\n - CVE-2016-8691, CVE-2016-8692: Divide by zero in jpc_dec_process_siz (bsc#1005090)\n\n - CVE-2016-8690: NULL pointer dereference in bmp_getdata triggered by crafted BMP image (bsc#1005084)\n\n - CVE-2016-2116: Memory leak in the jas_iccprof_createfrombuf function in JasPer allowed remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file (bsc#968373)\n\n - CVE-2016-2089: invalid read in the JasPer's jas_matrix_clip() function (bsc#963983)\n\n - CVE-2016-1867: Out-of-bounds Read in the JasPer's jpc_pi_nextcprl() function (bsc#961886)\n\n - CVE-2015-5221: Use-after-free (and double-free) in Jasper JPEG-200 (bsc#942553).\n\n - CVE-2015-5203: Double free corruption in JasPer JPEG-2000 implementation (bsc#941919)\n\n - CVE-2008-3522: Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer might have allowed context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (bsc#392410)\n\n - jasper: NULL pointer dereference in jp2_colr_destroy (jp2_cod.c) (incomplete fix for CVE-2016-8887) (bsc#1006839) For additional change description please have a look at the changelog.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2016-11-11T00:00:00", "type": "nessus", "title": "SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2016:2775-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2014-8158", "CVE-2015-5203", "CVE-2015-5221", "CVE-2016-1577", "CVE-2016-1867", "CVE-2016-2089", "CVE-2016-2116", "CVE-2016-8690", "CVE-2016-8691", "CVE-2016-8692", "CVE-2016-8693", "CVE-2016-8880", "CVE-2016-8881", "CVE-2016-8882", "CVE-2016-8883", "CVE-2016-8884", "CVE-2016-8885", "CVE-2016-8886", "CVE-2016-8887"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:jasper-debuginfo", "p-cpe:/a:novell:suse_linux:jasper-debugsource", "p-cpe:/a:novell:suse_linux:libjasper1", "p-cpe:/a:novell:suse_linux:libjasper1-debuginfo", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2016-2775-1.NASL", "href": "https://www.tenable.com/plugins/nessus/94728", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2016:2775-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(94728);\n script_version(\"2.10\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2008-3522\", \"CVE-2014-8158\", \"CVE-2015-5203\", \"CVE-2015-5221\", \"CVE-2016-1577\", \"CVE-2016-1867\", \"CVE-2016-2089\", \"CVE-2016-2116\", \"CVE-2016-8690\", \"CVE-2016-8691\", \"CVE-2016-8692\", \"CVE-2016-8693\", \"CVE-2016-8880\", \"CVE-2016-8881\", \"CVE-2016-8882\", \"CVE-2016-8883\", \"CVE-2016-8884\", \"CVE-2016-8885\", \"CVE-2016-8886\", \"CVE-2016-8887\");\n script_bugtraq_id(31470, 72293);\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2016:2775-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for jasper to version 1.900.14 fixes several issues. These\nsecurity issues were fixed :\n\n - CVE-2016-8887: NULL pointer dereference in\n jp2_colr_destroy (jp2_cod.c) (bsc#1006836)\n\n - CVE-2016-8886: memory allocation failure in jas_malloc\n (jas_malloc.c) (bsc#1006599)\n\n - CVE-2016-8884,CVE-2016-8885: two NULL pointer\n dereferences in bmp_getdata (incomplete fix for\n CVE-2016-8690) (bsc#1007009)\n\n - CVE-2016-8883: assert in jpc_dec_tiledecode()\n (bsc#1006598)\n\n - CVE-2016-8882: segfault / NULL pointer access in\n jpc_pi_destroy (bsc#1006597)\n\n - CVE-2016-8881: Heap overflow in jpc_getuint16()\n (bsc#1006593)\n\n - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox()\n (bsc#1006591)\n\n - CVE-2016-8693 Double free vulnerability in mem_close\n (bsc#1005242)\n\n - CVE-2016-8691, CVE-2016-8692: Divide by zero in\n jpc_dec_process_siz (bsc#1005090)\n\n - CVE-2016-8690: NULL pointer dereference in bmp_getdata\n triggered by crafted BMP image (bsc#1005084)\n\n - CVE-2016-2116: Memory leak in the\n jas_iccprof_createfrombuf function in JasPer allowed\n remote attackers to cause a denial of service (memory\n consumption) via a crafted ICC color profile in a JPEG\n 2000 image file (bsc#968373)\n\n - CVE-2016-2089: invalid read in the JasPer's\n jas_matrix_clip() function (bsc#963983)\n\n - CVE-2016-1867: Out-of-bounds Read in the JasPer's\n jpc_pi_nextcprl() function (bsc#961886)\n\n - CVE-2015-5221: Use-after-free (and double-free) in\n Jasper JPEG-200 (bsc#942553).\n\n - CVE-2015-5203: Double free corruption in JasPer\n JPEG-2000 implementation (bsc#941919)\n\n - CVE-2008-3522: Buffer overflow in the jas_stream_printf\n function in libjasper/base/jas_stream.c in JasPer might\n have allowed context-dependent attackers to have an\n unknown impact via vectors related to the mif_hdr_put\n function and use of vsprintf (bsc#392410)\n\n - jasper: NULL pointer dereference in jp2_colr_destroy\n (jp2_cod.c) (incomplete fix for CVE-2016-8887)\n (bsc#1006839) For additional change description please\n have a look at the changelog.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1005084\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1005090\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1005242\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006591\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006593\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006597\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006598\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006599\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006836\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1006839\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1007009\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=392410\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=941919\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=942553\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=961886\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=963983\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=968373\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2008-3522/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2014-8158/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5203/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2015-5221/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1577/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-1867/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2089/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-2116/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8690/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8691/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8692/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8693/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8880/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8881/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8882/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8883/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8884/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8885/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8886/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8887/\"\n );\n # https://www.suse.com/support/update/announcement/2016/suse-su-20162775-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c3af566f\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Software Development Kit 12-SP2:zypper in -t\npatch SUSE-SLE-SDK-12-SP2-2016-1639=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP1:zypper in -t\npatch SUSE-SLE-SDK-12-SP1-2016-1639=1\n\nSUSE Linux Enterprise Server for Raspberry Pi 12-SP2:zypper in -t\npatch SUSE-SLE-RPI-12-SP2-2016-1639=1\n\nSUSE Linux Enterprise Server 12-SP2:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-2016-1639=1\n\nSUSE Linux Enterprise Server 12-SP1:zypper in -t patch\nSUSE-SLE-SERVER-12-SP1-2016-1639=1\n\nSUSE Linux Enterprise Desktop 12-SP2:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP2-2016-1639=1\n\nSUSE Linux Enterprise Desktop 12-SP1:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP1-2016-1639=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:jasper-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:jasper-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjasper1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjasper1-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2008/10/02\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/11/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/11/11\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(1|2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP1/2\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(1|2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP1/2\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"jasper-debuginfo-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"jasper-debugsource-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libjasper1-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libjasper1-debuginfo-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libjasper1-32bit-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libjasper1-debuginfo-32bit-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"jasper-debuginfo-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"jasper-debugsource-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"libjasper1-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"libjasper1-debuginfo-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"libjasper1-32bit-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", cpu:\"x86_64\", reference:\"libjasper1-debuginfo-32bit-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"jasper-debuginfo-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"jasper-debugsource-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"libjasper1-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"libjasper1-32bit-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"libjasper1-debuginfo-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"1\", cpu:\"x86_64\", reference:\"libjasper1-debuginfo-32bit-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"jasper-debuginfo-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"jasper-debugsource-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libjasper1-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libjasper1-32bit-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libjasper1-debuginfo-1.900.14-181.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libjasper1-debuginfo-32bit-1.900.14-181.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jasper\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-08-19T12:39:40", "description": "This update for jasper to version 1.900.14 fixes several issues.\n\nThese security issues were fixed :\n\n - CVE-2008-3522: Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer might have allowed context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf (bsc#392410)\n\n - CVE-2015-5203: Double free corruption in JasPer JPEG-2000 implementation (bsc#941919).\n\n - CVE-2015-5221: Use-after-free (and double-free) in Jasper JPEG-200 (bsc#942553).\n\n - CVE-2016-1577: Double free vulnerability in the jas_iccattrval_destroy function in JasPer allowed remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137 (bsc#968373).\n\n - CVE-2016-2116: Memory leak in the jas_iccprof_createfrombuf function in JasPer allowed remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file (bsc#968373)\n\n - CVE-2016-8690: NULL pointer dereference in bmp_getdata triggered by crafted BMP image (bsc#1005084).\n\n - CVE-2016-8691, CVE-2016-8692: Missing range check on XRsiz and YRsiz fields of SIZ marker segment (bsc#1005090).\n\n - CVE-2016-8693: The memory stream interface allowed for a buffer size of zero. The case of a zero-sized buffer was not handled correctly, as it could lead to a double free (bsc#1005242).\n\n - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox() (bsc#1006591).\n\n - CVE-2016-8881: Heap overflow in jpc_getuint16() (bsc#1006593).\n\n - CVE-2016-8882: NULL pointer access in jpc_pi_destroy (bsc#1006597).\n\n - CVE-2016-8883: Assert triggered in jpc_dec_tiledecode() (bsc#1006598).\n\n - CVE-2016-8886: Memory allocation failure in jas_malloc (jas_malloc.c) (bsc#1006599).\n\n For additional change description please have a look at the changelog.", "cvss3": {"score": 7.8, "vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2016-11-07T00:00:00", "type": "nessus", "title": "openSUSE Security Update : jasper (openSUSE-2016-1270)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2011-4516", "CVE-2011-4517", "CVE-2014-8137", "CVE-2014-8138", "CVE-2014-8157", "CVE-2014-8158", "CVE-2014-9029", "CVE-2015-5203", "CVE-2015-5221", "CVE-2016-1577", "CVE-2016-1867", "CVE-2016-2089", "CVE-2016-2116", "CVE-2016-8690", "CVE-2016-8691", "CVE-2016-8692", "CVE-2016-8693", "CVE-2016-8880", "CVE-2016-8881", "CVE-2016-8882", "CVE-2016-8883", "CVE-2016-8884", "CVE-2016-8885", "CVE-2016-8886", "CVE-2016-8887"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:jasper", "p-cpe:/a:novell:opensuse:jasper-debuginfo", "p-cpe:/a:novell:opensuse:jasper-debugsource", "p-cpe:/a:novell:opensuse:libjasper-devel", "p-cpe:/a:novell:opensuse:libjasper1", "p-cpe:/a:novell:opensuse:libjasper1-32bit", "p-cpe:/a:novell:opensuse:libjasper1-debuginfo", "p-cpe:/a:novell:opensuse:libjasper1-debuginfo-32bit", "cpe:/o:novell:opensuse:13.1"], "id": "OPENSUSE-2016-1270.NASL", "href": "https://www.tenable.com/plugins/nessus/94601", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2016-1270.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(94601);\n script_version(\"2.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2008-3522\", \"CVE-2011-4516\", \"CVE-2011-4517\", \"CVE-2014-8137\", \"CVE-2014-8138\", \"CVE-2014-8157\", \"CVE-2014-8158\", \"CVE-2014-9029\", \"CVE-2015-5203\", \"CVE-2015-5221\", \"CVE-2016-1577\", \"CVE-2016-1867\", \"CVE-2016-2089\", \"CVE-2016-2116\", \"CVE-2016-8690\", \"CVE-2016-8691\", \"CVE-2016-8692\", \"CVE-2016-8693\", \"CVE-2016-8880\", \"CVE-2016-8881\", \"CVE-2016-8882\", \"CVE-2016-8883\", \"CVE-2016-8884\", \"CVE-2016-8885\", \"CVE-2016-8886\", \"CVE-2016-8887\");\n\n script_name(english:\"openSUSE Security Update : jasper (openSUSE-2016-1270)\");\n script_summary(english:\"Check for the openSUSE-2016-1270 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for jasper to version 1.900.14 fixes several issues.\n\nThese security issues were fixed :\n\n - CVE-2008-3522: Buffer overflow in the jas_stream_printf\n function in libjasper/base/jas_stream.c in JasPer might\n have allowed context-dependent attackers to have an\n unknown impact via vectors related to the mif_hdr_put\n function and use of vsprintf (bsc#392410)\n\n - CVE-2015-5203: Double free corruption in JasPer\n JPEG-2000 implementation (bsc#941919).\n\n - CVE-2015-5221: Use-after-free (and double-free) in\n Jasper JPEG-200 (bsc#942553).\n\n - CVE-2016-1577: Double free vulnerability in the\n jas_iccattrval_destroy function in JasPer allowed remote\n attackers to cause a denial of service (crash) or\n possibly execute arbitrary code via a crafted ICC color\n profile in a JPEG 2000 image file, a different\n vulnerability than CVE-2014-8137 (bsc#968373).\n\n - CVE-2016-2116: Memory leak in the\n jas_iccprof_createfrombuf function in JasPer allowed\n remote attackers to cause a denial of service (memory\n consumption) via a crafted ICC color profile in a JPEG\n 2000 image file (bsc#968373)\n\n - CVE-2016-8690: NULL pointer dereference in bmp_getdata\n triggered by crafted BMP image (bsc#1005084).\n\n - CVE-2016-8691, CVE-2016-8692: Missing range check on\n XRsiz and YRsiz fields of SIZ marker segment\n (bsc#1005090).\n\n - CVE-2016-8693: The memory stream interface allowed for a\n buffer size of zero. The case of a zero-sized buffer was\n not handled correctly, as it could lead to a double free\n (bsc#1005242).\n\n - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox()\n (bsc#1006591).\n\n - CVE-2016-8881: Heap overflow in jpc_getuint16()\n (bsc#1006593).\n\n - CVE-2016-8882: NULL pointer access in jpc_pi_destroy\n (bsc#1006597).\n\n - CVE-2016-8883: Assert triggered in jpc_dec_tiledecode()\n (bsc#1006598).\n\n - CVE-2016-8886: Memory allocation failure in jas_malloc\n (jas_malloc.c) (bsc#1006599).\n\n For additional change description please have a look at\n the changelog.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1005084\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1005090\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1005242\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006591\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006593\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006597\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006598\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006599\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006836\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1006839\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1007009\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=941919\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected jasper packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:jasper\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:jasper-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:jasper-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjasper1-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/11/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/11/07\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE13\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"13.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE13.1\", reference:\"jasper-1.900.14-160.25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"jasper-debuginfo-1.900.14-160.25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"jasper-debugsource-1.900.14-160.25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libjasper-devel-1.900.14-160.25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libjasper1-1.900.14-160.25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"libjasper1-debuginfo-1.900.14-160.25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libjasper1-32bit-1.900.14-160.25.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", cpu:\"x86_64\", reference:\"libjasper1-debuginfo-32bit-1.900.14-160.25.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"jasper / jasper-debuginfo / jasper-debugsource / libjasper-devel / etc\");\n}\n", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:28", "description": "- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\nGentoo Linux Security Advisory GLSA 200812-18\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n http://security.gentoo.org/\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n\r\n Severity: Normal\r\n Title: JasPer: User-assisted execution of arbitrary code\r\n Date: December 16, 2008\r\n Bugs: #222819\r\n ID: 200812-18\r\n\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n\r\nSynopsis\r\n========\r\n\r\nMultiple memory management errors in JasPer might lead to execution of\r\narbitrary code via jpeg2k files.\r\n\r\nBackground\r\n==========\r\n\r\nThe JasPer Project is an open-source initiative to provide a free\r\nsoftware-based reference implementation of the codec specified in the\r\nJPEG-2000 Part-1 (jpeg2k) standard.\r\n\r\nAffected packages\r\n=================\r\n\r\n -------------------------------------------------------------------\r\n Package / Vulnerable / Unaffected\r\n -------------------------------------------------------------------\r\n 1 media-libs/jasper < 1.900.1-r3 >= 1.900.1-r3\r\n\r\nDescription\r\n===========\r\n\r\nMarc Espie and Christian Weisgerber have discovered multiple\r\nvulnerabilities in JasPer:\r\n\r\n* Multiple integer overflows might allow for insufficient memory\r\n allocation, leading to heap-based buffer overflows (CVE-2008-3520).\r\n\r\n* The jas_stream_printf() function in libjasper/base/jas_stream.c\r\n uses vsprintf() to write user-provided data to a static to a buffer,\r\n leading to an overflow (CVE-2008-3522).\r\n\r\nImpact\r\n======\r\n\r\nRemote attackers could entice a user or automated system to process\r\nspecially crafted jpeg2k files with an application using JasPer,\r\npossibly leading to the execution of arbitrary code.\r\n\r\nWorkaround\r\n==========\r\n\r\nThere is no known workaround at this time.\r\n\r\nResolution\r\n==========\r\n\r\nAll JasPer users should upgrade to the latest version:\r\n\r\n # emerge --sync\r\n # emerge --ask --oneshot --verbose ">=media-libs/jasper-1.900.1-r3"\r\n\r\nReferences\r\n==========\r\n\r\n [ 1 ] CVE-2008-3520\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3520\r\n [ 2 ] CVE-2008-3522\r\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3522\r\n\r\nAvailability\r\n============\r\n\r\nThis GLSA and any updates to it are available for viewing at\r\nthe Gentoo Security Website:\r\n\r\n http://security.gentoo.org/glsa/glsa-200812-18.xml\r\n\r\nConcerns?\r\n=========\r\n\r\nSecurity is a primary focus of Gentoo Linux and ensuring the\r\nconfidentiality and security of our users machines is of utmost\r\nimportance to us. Any security concerns should be addressed to\r\nsecurity@gentoo.org or alternatively, you may file a bug at\r\nhttp://bugs.gentoo.org.\r\n\r\nLicense\r\n=======\r\n\r\nCopyright 2008 Gentoo Foundation, Inc; referenced text\r\nbelongs to its owner(s).\r\n\r\nThe contents of this document are licensed under the\r\nCreative Commons - Attribution / Share Alike license.\r\n\r\nhttp://creativecommons.org/licenses/by-sa/2.5", "edition": 1, "cvss3": {}, "published": "2008-12-17T00:00:00", "title": "[ GLSA 200812-18 ] JasPer: User-assisted execution of arbitrary code", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520"], "modified": "2008-12-17T00:00:00", "id": "SECURITYVULNS:DOC:21035", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:21035", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:29", "description": "===========================================================\r\nUbuntu Security Notice USN-742-1 March 19, 2009\r\njasper vulnerabilities\r\nCVE-2008-3520, CVE-2008-3521, CVE-2008-3522\r\n===========================================================\r\n\r\nA security issue affects the following Ubuntu releases:\r\n\r\nUbuntu 6.06 LTS\r\nUbuntu 7.10\r\nUbuntu 8.04 LTS\r\nUbuntu 8.10\r\n\r\nThis advisory also applies to the corresponding versions of\r\nKubuntu, Edubuntu, and Xubuntu.\r\n\r\nThe problem can be corrected by upgrading your system to the\r\nfollowing package versions:\r\n\r\nUbuntu 6.06 LTS:\r\n libjasper-1.701-1 1.701.0-2ubuntu0.6.06.1\r\n\r\nUbuntu 7.10:\r\n libjasper1 1.900.1-3ubuntu0.7.10.1\r\n\r\nUbuntu 8.04 LTS:\r\n libjasper1 1.900.1-3ubuntu0.8.04.1\r\n\r\nUbuntu 8.10:\r\n libjasper1 1.900.1-5ubuntu0.1\r\n\r\nIn general, a standard system upgrade is sufficient to effect the\r\nnecessary changes.\r\n\r\nDetails follow:\r\n\r\nIt was discovered that JasPer did not correctly handle memory allocation\r\nwhen parsing certain malformed JPEG2000 images. If a user were tricked into\r\nopening a specially crafted image with an application that uses libjasper,\r\nan attacker could cause a denial of service and possibly execute arbitrary\r\ncode with the user's privileges. (CVE-2008-3520)\r\n\r\nIt was discovered that JasPer created temporary files in an insecure way.\r\nLocal users could exploit a race condition and cause a denial of service in\r\nlibjasper applications.\r\n(CVE-2008-3521)\r\n\r\nIt was discovered that JasPer did not correctly handle certain formatting\r\noperations. If a user were tricked into opening a specially crafted image\r\nwith an application that uses libjasper, an attacker could cause a denial\r\nof service and possibly execute arbitrary code with the user's privileges.\r\n(CVE-2008-3522)\r\n\r\n\r\nUpdated packages for Ubuntu 6.06 LTS:\r\n\r\n Source archives:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.06.1.diff.gz\r\n Size/MD5: 34544 cce3c647820e55fae518eb081a77545a\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0-2ubuntu0.6.06.1.dsc\r\n Size/MD5: 715 3f7c5d2155ab4f259aab9bcc8aa64c0a\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.701.0.orig.tar.gz\r\n Size/MD5: 1084413 ceed8e5e4fc58ac8faca0bd4be8a7b7d\r\n\r\n amd64 architecture (Athlon64, Opteron, EM64T Xeon):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_amd64.deb\r\n Size/MD5: 146814 020471e3651a9c2fafd6eefedadb3f75\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_amd64.deb\r\n Size/MD5: 636044 a614b7cd20832821f75ae66bcf639675\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_amd64.deb\r\n Size/MD5: 24296 a799121b0c020afa47dda1454c777aa8\r\n\r\n i386 architecture (x86 compatible Intel/AMD):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_i386.deb\r\n Size/MD5: 133552 7b3aebd21e1506b8cde1d0ab2602b685\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_i386.deb\r\n Size/MD5: 619430 c5739e01e9d69506da8e6d956d05af96\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_i386.deb\r\n Size/MD5: 21890 6f01dc80f5a3dbd14325935e755301ee\r\n\r\n powerpc architecture (Apple Macintosh G3/G4/G5):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_powerpc.deb\r\n Size/MD5: 142700 e1253e0a77c84326db1dac4317ca196d\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_powerpc.deb\r\n Size/MD5: 624160 fec9bc6cacf18fb5fbe42183e9dbdf08\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_powerpc.deb\r\n Size/MD5: 27932 31413f853f0a0ce38ed6355200f377f5\r\n\r\n sparc architecture (Sun SPARC/UltraSPARC):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-1_1.701.0-2ubuntu0.6.06.1_sparc.deb\r\n Size/MD5: 133302 a9f4ba112f2bf58554120454072b57a8\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-1.701-dev_1.701.0-2ubuntu0.6.06.1_sparc.deb\r\n Size/MD5: 623384 a5863b651eaedfdff5c9deaacb26dbb9\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.701.0-2ubuntu0.6.06.1_sparc.deb\r\n Size/MD5: 22492 f711a38841e73fd99ef8146d8aca8eae\r\n\r\nUpdated packages for Ubuntu 7.10:\r\n\r\n Source archives:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.7.10.1.diff.gz\r\n Size/MD5: 49782 f6b41bf096b45f95964bde8822419e22\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.7.10.1.dsc\r\n Size/MD5: 787 84f1be39211afbf546f4865aa2c93b93\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1.orig.tar.gz\r\n Size/MD5: 1143400 4ae3dd938fd15f22f30577db5c9f27e9\r\n\r\n amd64 architecture (Athlon64, Opteron, EM64T Xeon):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_amd64.deb\r\n Size/MD5: 560066 121337bb5de35638aee77f2e6f5b4175\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_amd64.deb\r\n Size/MD5: 151764 304a3001b55dda77b03b87b58dcce17e\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_amd64.deb\r\n Size/MD5: 25552 6cf1e402a960a58ee076513f7224bd93\r\n\r\n i386 architecture (x86 compatible Intel/AMD):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_i386.deb\r\n Size/MD5: 548268 51fd5964f1593d5c5652d82f94be2f65\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_i386.deb\r\n Size/MD5: 144134 4051b7784cf9167f394bc0543758aadc\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_i386.deb\r\n Size/MD5: 23126 f1c103e3b437b004c62044e77a6fd789\r\n\r\n lpia architecture (Low Power Intel Architecture):\r\n\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_lpia.deb\r\n Size/MD5: 548046 03c662544f78e41aa52b4eb0cef88f5e\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_lpia.deb\r\n Size/MD5: 145604 f163501caa0ec88be92150e27177be07\r\n http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_lpia.deb\r\n Size/MD5: 23288 b231d9da0cd70d816dc8aa0324d02f81\r\n\r\n powerpc architecture (Apple Macintosh G3/G4/G5):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_powerpc.deb\r\n Size/MD5: 554840 6ed5498df3429753a6b8149ff35d9713\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_powerpc.deb\r\n Size/MD5: 156696 6d6301d54dcfcb54351c8b7a29cd0e98\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_powerpc.deb\r\n Size/MD5: 31970 64002762586577cd40494a75daf072c6\r\n\r\n sparc architecture (Sun SPARC/UltraSPARC):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.7.10.1_sparc.deb\r\n Size/MD5: 546862 bad1d4f79ac9a0abfe4b722ca94299a9\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.7.10.1_sparc.deb\r\n Size/MD5: 138864 059db193b061fe0152be74ff6f7afe0d\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.7.10.1_sparc.deb\r\n Size/MD5: 24654 3f7c1c3623b76ef1bf87a4e269ce0959\r\n\r\nUpdated packages for Ubuntu 8.04 LTS:\r\n\r\n Source archives:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.8.04.1.diff.gz\r\n Size/MD5: 49784 140289a8237818c78c094142470562be\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-3ubuntu0.8.04.1.dsc\r\n Size/MD5: 787 d110d94a13ba861e16d5a53d2fa06a0d\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1.orig.tar.gz\r\n Size/MD5: 1143400 4ae3dd938fd15f22f30577db5c9f27e9\r\n\r\n amd64 architecture (Athlon64, Opteron, EM64T Xeon):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_amd64.deb\r\n Size/MD5: 560628 5ad790436c98d5b9cf0a6d4b31676999\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_amd64.deb\r\n Size/MD5: 149284 3e91312e9bfec2f8f15cbb6c7137276c\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_amd64.deb\r\n Size/MD5: 25430 b587ab277fd41171e0f1f1576e2d9ca8\r\n\r\n i386 architecture (x86 compatible Intel/AMD):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_i386.deb\r\n Size/MD5: 548014 81bfeab149dd028ab86b682910248264\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_i386.deb\r\n Size/MD5: 140772 099c812e2107df16ec5f448fd4dd24ee\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_i386.deb\r\n Size/MD5: 23250 5c4bb207c9eab2d64e7d2012f2adebe7\r\n\r\n lpia architecture (Low Power Intel Architecture):\r\n\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_lpia.deb\r\n Size/MD5: 547934 4f03a5626dde55be41d3403b07aacb27\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_lpia.deb\r\n Size/MD5: 142492 a07e3596c6b2d436402a1658582b3e06\r\n http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_lpia.deb\r\n Size/MD5: 23258 e280973f4522be895b4e3c06fcdf7a6f\r\n\r\n powerpc architecture (Apple Macintosh G3/G4/G5):\r\n\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_powerpc.deb\r\n Size/MD5: 554736 e51d72ed422e517dd93602585732713a\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_powerpc.deb\r\n Size/MD5: 151722 c11f4cdae73aac0cb3b265ba59fbfff0\r\n http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_powerpc.deb\r\n Size/MD5: 32328 d168c11f56f84810e7ed072c615497a3\r\n\r\n sparc architecture (Sun SPARC/UltraSPARC):\r\n\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-3ubuntu0.8.04.1_sparc.deb\r\n Size/MD5: 545368 e32366827751c4747af02d1706f23192\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-3ubuntu0.8.04.1_sparc.deb\r\n Size/MD5: 136120 f6b6f67d4d6ce88fb1edc6f4528bb678\r\n http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-3ubuntu0.8.04.1_sparc.deb\r\n Size/MD5: 24538 f8aba59b6f69e220cf6e68a3bfb71d37\r\n\r\nUpdated packages for Ubuntu 8.10:\r\n\r\n Source archives:\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-5ubuntu0.1.diff.gz\r\n Size/MD5: 52688 1b4d2d4ee9a459a451913b675b263d62\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1-5ubuntu0.1.dsc\r\n Size/MD5: 1187 fb314df8a6f5247edb747987f8d76f02\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/jasper_1.900.1.orig.tar.gz\r\n Size/MD5: 1143400 4ae3dd938fd15f22f30577db5c9f27e9\r\n\r\n amd64 architecture (Athlon64, Opteron, EM64T Xeon):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_amd64.deb\r\n Size/MD5: 562142 c2f25e04c912a1b64c4dfce1eb7dd3d5\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_amd64.deb\r\n Size/MD5: 151868 6e8b66b557cc7a794c6c14fb6d588d81\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_amd64.deb\r\n Size/MD5: 25758 ca74bf783944c89242555b641b2e5f90\r\n\r\n i386 architecture (x86 compatible Intel/AMD):\r\n\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_i386.deb\r\n Size/MD5: 550168 812497f62590b915fd0329e810295675\r\n http://security.ubuntu.com/ubuntu/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_i386.deb\r\n Size/MD5: 143290 d9c1b2e6abca55d5fc8bd2a0408887d9\r\n http://security.ubuntu.com/ubuntu/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_i386.deb\r\n Size/MD5: 23616 af8d3d8dcdf8ec7e92b470bd3e0edfc5\r\n\r\n lpia architecture (Low Power Intel Architecture):\r\n\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_lpia.deb\r\n Size/MD5: 549832 8be0a5f2995b25b20cdb0bd8608a9b2d\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_lpia.deb\r\n Size/MD5: 144942 6655936af1cd1a43455b25b5fca92c7e\r\n http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_lpia.deb\r\n Size/MD5: 23516 dc7791cea2c443a07c9eba67944873b8\r\n\r\n powerpc architecture (Apple Macintosh G3/G4/G5):\r\n\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_powerpc.deb\r\n Size/MD5: 557240 da2293d915a7fe54cb28af6d1c492dda\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_powerpc.deb\r\n Size/MD5: 154072 885f88a8d11e3b2375fd7633b0d18f60\r\n http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_powerpc.deb\r\n Size/MD5: 31458 f17ad2b7f030b844ef1bc01db1b07cd5\r\n\r\n sparc architecture (Sun SPARC/UltraSPARC):\r\n\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper-dev_1.900.1-5ubuntu0.1_sparc.deb\r\n Size/MD5: 545474 cb6fdbec36215740768dde9466434151\r\n http://ports.ubuntu.com/pool/main/j/jasper/libjasper1_1.900.1-5ubuntu0.1_sparc.deb\r\n Size/MD5: 136986 1940aab6c284ec22bd70b4a5ee6b432a\r\n http://ports.ubuntu.com/pool/universe/j/jasper/libjasper-runtime_1.900.1-5ubuntu0.1_sparc.deb\r\n Size/MD5: 24666 2716a795c39dea1835cd9f69f9e061c3\r\n\r\n", "edition": 1, "cvss3": {}, "published": "2009-03-20T00:00:00", "title": "[USN-742-1] JasPer vulnerabilities", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2009-03-20T00:00:00", "id": "SECURITYVULNS:DOC:21504", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:21504", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2021-06-08T19:00:46", "description": "Integer overflow on JPEG2000 processing, format string vulnerability, symbolic links problem.", "edition": 2, "cvss3": {}, "published": "2009-03-20T00:00:00", "title": "Jasper library multiplesecurity vulnerabilities", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2008-3522", "CVE-2008-3520", "CVE-2008-3521"], "modified": "2009-03-20T00:00:00", "id": "SECURITYVULNS:VULN:9759", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:9759", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2021-06-08T19:00:46", "description": "Multiple memory corruptions on JPEG parsing.", "edition": 2, "cvss3": {}, "published": "2008-12-17T00:00:00", "title": "JasPer multiple security vulnerabilities", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2008-3522"], "modified": "2008-12-17T00:00:00", "id": "SECURITYVULNS:VULN:9523", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:9523", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "fedora": [{"lastseen": "2020-12-21T08:17:49", "description": "This package contains an implementation of the image compression standard JPEG-2000, Part 1. It consists of tools for conversion to and from the JP2 and JPC formats. ", "cvss3": {}, "published": "2009-10-27T06:43:29", "type": "fedora", "title": "[SECURITY] Fedora 11 Update: jasper-1.900.1-13.fc11", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522"], "modified": "2009-10-27T06:43:29", "id": "FEDORA:57CE510F880", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NQWYZ3VTZOFCBAFJSTTSBTPERM5M2GZ3/", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "gentoo": [{"lastseen": "2022-01-17T19:14:49", "description": "### Background\n\nThe JasPer Project is an open-source initiative to provide a free software-based reference implementation of the codec specified in the JPEG-2000 Part-1 (jpeg2k) standard. \n\n### Description\n\nMarc Espie and Christian Weisgerber have discovered multiple vulnerabilities in JasPer: \n\n * Multiple integer overflows might allow for insufficient memory allocation, leading to heap-based buffer overflows (CVE-2008-3520). \n * The jas_stream_printf() function in libjasper/base/jas_stream.c uses vsprintf() to write user-provided data to a static to a buffer, leading to an overflow (CVE-2008-3522). \n\n### Impact\n\nRemote attackers could entice a user or automated system to process specially crafted jpeg2k files with an application using JasPer, possibly leading to the execution of arbitrary code. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll JasPer users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=media-libs/jasper-1.900.1-r3\"", "cvss3": {}, "published": "2008-12-16T00:00:00", "type": "gentoo", "title": "JasPer: User-assisted execution of arbitrary code", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522"], "modified": "2008-12-16T00:00:00", "id": "GLSA-200812-18", "href": "https://security.gentoo.org/glsa/200812-18", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2022-01-04T13:28:40", "description": "It was discovered that JasPer did not correctly handle memory allocation \nwhen parsing certain malformed JPEG2000 images. If a user were tricked into \nopening a specially crafted image with an application that uses libjasper, \nan attacker could cause a denial of service and possibly execute arbitrary \ncode with the user's privileges. (CVE-2008-3520)\n\nIt was discovered that JasPer created temporary files in an insecure way. \nLocal users could exploit a race condition and cause a denial of service in \nlibjasper applications. \n(CVE-2008-3521)\n\nIt was discovered that JasPer did not correctly handle certain formatting \noperations. If a user were tricked into opening a specially crafted image \nwith an application that uses libjasper, an attacker could cause a denial \nof service and possibly execute arbitrary code with the user's privileges. \n(CVE-2008-3522)\n", "cvss3": {}, "published": "2009-03-19T00:00:00", "type": "ubuntu", "title": "JasPer vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3520", "CVE-2008-3521", "CVE-2008-3522"], "modified": "2009-03-19T00:00:00", "id": "USN-742-1", "href": "https://ubuntu.com/security/notices/USN-742-1", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-01-04T13:08:35", "description": "It was discovered that Ghostscript did not correctly handle memory \nallocation when parsing certain malformed JPEG-2000 images. If a user or \nautomated system were tricked into opening a specially crafted image, an \nattacker could cause a denial of service and possibly execute arbitrary \ncode with user privileges. (CVE-2008-3520)\n\nIt was discovered that Ghostscript did not correctly handle certain \nformatting operations when parsing JPEG-2000 images. If a user or automated \nsystem were tricked into opening a specially crafted image, an attacker \ncould cause a denial of service and possibly execute arbitrary code with \nuser privileges. (CVE-2008-3522)\n\nIt was discovered that Ghostscript incorrectly handled certain malformed \nTrueType fonts. If a user or automated system were tricked into opening a \ndocument containing a specially crafted font, an attacker could cause a \ndenial of service and possibly execute arbitrary code with user privileges. \nThis issue only affected Ubuntu 8.04 LTS. (CVE-2009-3743)\n\nIt was discovered that Ghostscript incorrectly handled certain malformed \nType 2 fonts. If a user or automated system were tricked into opening a \ndocument containing a specially crafted font, an attacker could cause a \ndenial of service and possibly execute arbitrary code with user privileges. \nThis issue only affected Ubuntu 8.04 LTS. (CVE-2010-4054)\n\nJonathan Foote discovered that Ghostscript incorrectly handled certain \nmalformed JPEG-2000 image files. If a user or automated system were tricked \ninto opening a specially crafted JPEG-2000 image file, an attacker could \ncause Ghostscript to crash or possibly execute arbitrary code with user \nprivileges. (CVE-2011-4516, CVE-2011-4517)\n", "cvss3": {}, "published": "2012-01-04T00:00:00", "type": "ubuntu", "title": "Ghostscript vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2011-4516", "CVE-2011-4517", "CVE-2008-3520", "CVE-2009-3743", "CVE-2008-3522", "CVE-2010-4054"], "modified": "2012-01-04T00:00:00", "id": "USN-1317-1", "href": "https://ubuntu.com/security/notices/USN-1317-1", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "freebsd": [{"lastseen": "2022-01-19T15:51:33", "description": "\n\nFedora reports:\n\nJasPer fails to properly decode marker segments and other\n\t sections in malformed JPEG2000 files. Malformed inputs can\n\t cause heap buffer overflows which in turn may result in\n\t execution of attacker-controlled code.\n\n\n", "cvss3": {}, "published": "2011-12-09T00:00:00", "type": "freebsd", "title": "jasper -- buffer overflow", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522", "CVE-2011-4516", "CVE-2011-4517"], "modified": "2011-12-09T00:00:00", "id": "8FF84335-A7DA-11E2-B3F5-003067C2616F", "href": "https://vuxml.freebsd.org/freebsd/8ff84335-a7da-11e2-b3f5-003067c2616f.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "ubuntucve": [{"lastseen": "2021-11-22T22:00:35", "description": "Buffer overflow in the jas_stream_printf function in\nlibjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent\nattackers to have an unknown impact via vectors related to the mif_hdr_put\nfunction and use of vsprintf.\n\n#### Bugs\n\n * <http://bugs.gentoo.org/show_bug.cgi?id=222819>\n * <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-3522>\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=501021>\n", "cvss3": {}, "published": "2008-10-02T00:00:00", "type": "ubuntucve", "title": "CVE-2008-3522", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3522"], "modified": "2008-10-02T00:00:00", "id": "UB:CVE-2008-3522", "href": "https://ubuntu.com/security/CVE-2008-3522", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-11-22T22:00:35", "description": "Multiple integer overflows in JasPer 1.900.1 might allow context-dependent\nattackers to have an unknown impact via a crafted image file, related to\ninteger multiplication for memory allocation.\n\n#### Bugs\n\n * <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-3520>\n * <http://bugs.gentoo.org/show_bug.cgi?id=222819>\n * <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=501021>\n\n\n#### Notes\n\nAuthor| Note \n---|--- \n[mdeslaur](<https://launchpad.net/~mdeslaur>) | RH released netpbm with this CVE, as it shared code with jasper our netpbm-free doesn't appear to.\n", "cvss3": {}, "published": "2008-10-02T00:00:00", "type": "ubuntucve", "title": "CVE-2008-3520", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3520"], "modified": "2008-10-02T00:00:00", "id": "UB:CVE-2008-3520", "href": "https://ubuntu.com/security/CVE-2008-3520", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "debiancve": [{"lastseen": "2022-04-23T03:32:19", "description": "Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.", "cvss3": {}, "published": "2008-10-02T18:18:00", "type": "debiancve", "title": "CVE-2008-3522", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3522"], "modified": "2008-10-02T18:18:00", "id": "DEBIANCVE:CVE-2008-3522", "href": "https://security-tracker.debian.org/tracker/CVE-2008-3522", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-04-23T03:32:19", "description": "Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.", "cvss3": {}, "published": "2008-10-02T18:18:00", "type": "debiancve", "title": "CVE-2008-3520", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3520"], "modified": "2008-10-02T18:18:00", "id": "DEBIANCVE:CVE-2008-3520", "href": "https://security-tracker.debian.org/tracker/CVE-2008-3520", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "cve": [{"lastseen": "2022-03-23T12:34:40", "description": "Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.", "cvss3": {}, "published": "2008-10-02T18:18:00", "type": "cve", "title": "CVE-2008-3522", "cwe": ["CWE-119"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3522"], "modified": "2017-08-08T01:31:00", "cpe": ["cpe:/a:jasper_project:jasper:1.900.1", "cpe:/a:redhat:enterprise_virtualization:3.5"], "id": "CVE-2008-3522", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3522", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:redhat:enterprise_virtualization:3.5:*:*:*:*:*:*:*", "cpe:2.3:a:jasper_project:jasper:1.900.1:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T12:34:38", "description": "Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.", "cvss3": {}, "published": "2008-10-02T18:18:00", "type": "cve", "title": "CVE-2008-3520", "cwe": ["CWE-189"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3520"], "modified": "2017-09-29T01:31:00", "cpe": ["cpe:/a:jasper_project:jasper:1.900.1"], "id": "CVE-2008-3520", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3520", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:jasper_project:jasper:1.900.1:*:*:*:*:*:*:*"]}, {"lastseen": "2022-03-23T12:34:34", "description": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-3522. Reason: This candidate is a reservation duplicate of CVE-2008-3522. Notes: All CVE users should reference CVE-2008-3522 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.", "cvss3": {}, "published": "2009-03-26T10:12:00", "type": "cve", "title": "CVE-2008-3517", "cwe": [], "bulletinFamily": "NVD", "cvss2": {}, "cvelist": ["CVE-2008-3517", "CVE-2008-3522"], "modified": "2009-03-26T10:12:00", "cpe": [], "id": "CVE-2008-3517", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3517", "cvss": {"score": 0.0, "vector": "NONE"}, "cpe23": []}], "centos": [{"lastseen": "2022-02-27T12:03:08", "description": "**CentOS Errata and Security Advisory** CESA-2009:0012\n\n\nThe netpbm package contains a library of functions for editing and\nconverting between various graphics file formats, including .pbm (portable\nbitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable\npixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were discovered in\nthe JasPer library providing support for JPEG-2000 image format and used in\nthe jpeg2ktopam and pamtojpeg2k converters. An attacker could create a\ncarefully-crafted JPEG file which could cause jpeg2ktopam to crash or,\npossibly, execute arbitrary code as the user running jpeg2ktopam.\n(CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which contain\nbackported patches which resolve these issues.\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2009-February/052550.html\nhttps://lists.centos.org/pipermail/centos-announce/2009-February/052551.html\nhttps://lists.centos.org/pipermail/centos-announce/2009-February/052556.html\nhttps://lists.centos.org/pipermail/centos-announce/2009-February/052558.html\n\n**Affected packages:**\nnetpbm\nnetpbm-devel\nnetpbm-progs\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2009:0012", "cvss3": {}, "published": "2009-02-11T19:31:04", "type": "centos", "title": "netpbm security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2009-02-12T17:53:57", "id": "CESA-2009:0012", "href": "https://lists.centos.org/pipermail/centos-announce/2009-February/052550.html", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "redhat": [{"lastseen": "2021-10-21T04:46:16", "description": "The netpbm package contains a library of functions for editing and\nconverting between various graphics file formats, including .pbm (portable\nbitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable\npixmaps), and others.\n\nAn input validation flaw and multiple integer overflows were discovered in\nthe JasPer library providing support for JPEG-2000 image format and used in\nthe jpeg2ktopam and pamtojpeg2k converters. An attacker could create a\ncarefully-crafted JPEG file which could cause jpeg2ktopam to crash or,\npossibly, execute arbitrary code as the user running jpeg2ktopam.\n(CVE-2007-2721, CVE-2008-3520)\n\nAll users are advised to upgrade to these updated packages which contain\nbackported patches which resolve these issues.", "cvss3": {}, "published": "2009-02-11T00:00:00", "type": "redhat", "title": "(RHSA-2009:0012) Moderate: netpbm security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2017-09-08T07:49:57", "id": "RHSA-2009:0012", "href": "https://access.redhat.com/errata/RHSA-2009:0012", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-10-19T20:40:29", "description": "Red Hat Enterprise Virtualization Manager provides access to virtual\nmachines using SPICE. These SPICE client packages provide the SPICE client\nand usbclerk service for both Windows 32-bit operating systems and Windows\n64-bit operating systems.\n\nThis update adds support for the TLS Fallback Signaling Cipher Suite Value\n(TLS_FALLBACK_SCSV), which can be used to prevent protocol downgrade\nattacks against applications which re-connect using a lower SSL/TLS\nprotocol version when the initial connection indicating the highest\nsupported protocol version fails.\n\nThis can prevent a forceful downgrade of the communication to SSL 3.0.\nThe SSL 3.0 protocol was found to be vulnerable to the padding oracle\nattack when using block cipher suites in cipher block chaining (CBC) mode.\nThis issue is identified as CVE-2014-3566, and also known under the alias\nPOODLE. This SSL 3.0 protocol flaw will not be addressed in a future\nupdate; it is recommended that users configure their applications to\nrequire at least TLS protocol version 1.0 for secure communication.\n\nFor additional information about this flaw, see the Knowledgebase article\nat https://access.redhat.com/articles/1232123\n\nMultiple flaws were found in the way JasPer decoded JPEG 2000 image files.\nA specially crafted file could cause an application using JasPer to crash\nor, possibly, execute arbitrary code. (CVE-2014-8138, CVE-2014-8157,\nCVE-2014-8158, CVE-2014-9029, CVE-2014-8137, CVE-2011-4516, CVE-2011-4517,\nCVE-2008-3520, CVE-2008-3522)\n\nRed Hat would like to thank oCERT for reporting CVE-2014-8137,\nCVE-2014-8138, CVE-2014-8157, CVE-2014-8158, CVE-2014-9029, CVE-2011-4516,\nand CVE-2011-4517. oCERT acknowledges Jose Duart of the Google Security\nTeam as the original reporter of CVE-2014-8137 and CVE-2014-8138; and\npyddeh as the original reporter of CVE-2014-8157 and CVE-2014-8158.\n\nThe mingw-openssl and mingw-jasper packages have been upgraded to the\nlatest upstream version, which provides a number of bug fixes and\nenhancements over the previous version. (BZ#1187585)\n\nThis update also fixes the following bugs:\n\n* Previously, a guest system installed with tools incorrectly always\nstarted in full screen mode, even when the \"Open in Full Screen\" option was\nunchecked in console options. Now, when connecting in window mode with the\noption unchecked, the guest system starts in a window as expected.\n(BZ#1172126)\n\n* Prior to this update, copying and pasting of images from the client to\nthe guest did not work when spice-gtk was built from upstream. Now, images\ncan be copied and pasted without problems. (BZ#1187270)\n\nIn addition, this update adds the following enhancement:\n\n* Administrators now have the option of automatic multiuser installation of\nvirt-viewer onto many client workstations. (BZ#1187272)\n\nAll rhevm-spice-client users are advised to upgrade to these updated\npackages, which correct these issues and add these enhancement.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 3.4, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 1.4}, "published": "2015-03-18T00:00:00", "type": "redhat", "title": "(RHSA-2015:0698) Important: rhevm-spice-client security, bug fix, and enhancement update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522", "CVE-2011-4516", "CVE-2011-4517", "CVE-2014-3566", "CVE-2014-8137", "CVE-2014-8138", "CVE-2014-8157", "CVE-2014-8158", "CVE-2014-9029"], "modified": "2018-06-07T05:00:29", "id": "RHSA-2015:0698", "href": "https://access.redhat.com/errata/RHSA-2015:0698", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:34:46", "description": "[10.35-6.1.el5_3.1]\n- fix NVR to be greater than previous release in the main branch\nRelated: #472947\n[10.35-6.el5_3.1]\n- fix CVE-2007-2721 and CVE-2008-3520 libjasper issues (#472947)\nResolves: #472947", "cvss3": {}, "published": "2009-02-11T00:00:00", "type": "oraclelinux", "title": "netpbm security update", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2007-2721", "CVE-2008-3520"], "modified": "2009-02-11T00:00:00", "id": "ELSA-2009-0012", "href": "http://linux.oracle.com/errata/ELSA-2009-0012.html", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "slackware": [{"lastseen": "2021-07-28T14:46:41", "description": "New jasper packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,\nand -current to fix security issues.\n\n\nHere are the details from the Slackware 14.1 ChangeLog:\n\npatches/packages/jasper-1.900.1-i486-4_slack14.1.txz: Rebuilt.\n Applied many security and bug fixes.\n Thanks to Heinz Wiesinger.\n For more information, see:\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3520\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3522\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4516\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4517\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8137\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8138\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8157\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8158\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9029\n (* Security fix *)\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/jasper-1.900.1-i486-3_slack13.0.txz\n\nUpdated package for Slackware x86_64 13.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/jasper-1.900.1-x86_64-3_slack13.0.txz\n\nUpdated package for Slackware 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/jasper-1.900.1-i486-4_slack13.1.txz\n\nUpdated package for Slackware x86_64 13.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/jasper-1.900.1-x86_64-4_slack13.1.txz\n\nUpdated package for Slackware 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/jasper-1.900.1-i486-4_slack13.37.txz\n\nUpdated package for Slackware x86_64 13.37:\nftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/jasper-1.900.1-x86_64-4_slack13.37.txz\n\nUpdated package for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/jasper-1.900.1-i486-4_slack14.0.txz\n\nUpdated package for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/jasper-1.900.1-x86_64-4_slack14.0.txz\n\nUpdated package for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/jasper-1.900.1-i486-4_slack14.1.txz\n\nUpdated package for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/jasper-1.900.1-x86_64-4_slack14.1.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/jasper-1.900.1-i586-5.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/jasper-1.900.1-x86_64-5.txz\n\n\nMD5 signatures:\n\nSlackware 13.0 package:\n5156625217cd39753e427d30a8e994d2 jasper-1.900.1-i486-3_slack13.0.txz\n\nSlackware x86_64 13.0 package:\n6d7e1fe5d90acf882a799c7a4f07a447 jasper-1.900.1-x86_64-3_slack13.0.txz\n\nSlackware 13.1 package:\n4af3cca993d4b50be8cc59a9599bfc3e jasper-1.900.1-i486-4_slack13.1.txz\n\nSlackware x86_64 13.1 package:\n3c2da5e24db15cb4ac0436bb9c99ce31 jasper-1.900.1-x86_64-4_slack13.1.txz\n\nSlackware 13.37 package:\ne28b5780bb6bc2268d6d0aa3e934857c jasper-1.900.1-i486-4_slack13.37.txz\n\nSlackware x86_64 13.37 package:\n3ed6279730f6166b9caeaa0057e70afe jasper-1.900.1-x86_64-4_slack13.37.txz\n\nSlackware 14.0 package:\n379669370567a56e10524cd8a617b9d5 jasper-1.900.1-i486-4_slack14.0.txz\n\nSlackware x86_64 14.0 package:\n709a08d0f7c1cc2ff137413535b8733b jasper-1.900.1-x86_64-4_slack14.0.txz\n\nSlackware 14.1 package:\n0eb7e527854fbf3b2c72632015466069 jasper-1.900.1-i486-4_slack14.1.txz\n\nSlackware x86_64 14.1 package:\n75303d94123548515bc2913d83ec52cc jasper-1.900.1-x86_64-4_slack14.1.txz\n\nSlackware -current package:\nf1a1b8c0d3efe48c47665b1d88bcf8e9 l/jasper-1.900.1-i586-5.txz\n\nSlackware x86_64 -current package:\n31b75bd030af924b1a23e8763b9570e9 l/jasper-1.900.1-x86_64-5.txz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg jasper-1.900.1-i486-4_slack14.1.txz", "cvss3": {}, "published": "2015-10-29T22:48:48", "type": "slackware", "title": "[slackware-security] jasper", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-3520", "CVE-2008-3522", "CVE-2011-4516", "CVE-2011-4517", "CVE-2014-8137", "CVE-2014-8138", "CVE-2014-8157", "CVE-2014-8158", "CVE-2014-9029"], "modified": "2015-10-29T22:48:48", "id": "SSA-2015-302-02", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2015&m=slackware-security.538606", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "debian": [{"lastseen": "2022-01-07T00:54:56", "description": "- ------------------------------------------------------------------------\nDebian Security Advisory DSA-2080-1 security@debian.org\nhttp://www.debian.org/security/ Moritz Muehlenhoff\nAugust 01, 2010 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : ghostscript\nVulnerability : several\nProblem type : local(remote)\nDebian-specific: no\nCVE Id(s) : CVE-2007-6725 CVE-2008-3522 CVE-2008-6679 CVE-2009-0196 CVE-2009-0792 CVE-2009-4270 CVE-2010-1869\n\nSeveral security issues have been discovered in Ghostscript, the GPL\nPostScript/PDF interpreter, which might lead to the execution of\narbitrary code if a user processes a malformed PDF or Postscript file.\n\nFor the stable distribution (lenny), these problems have been fixed in\nversion 8.62.dfsg.1-3.2lenny4.\n\nFor the unstable distribution (sid), these problems have been fixed in\nversion 8.71~dfsg-4.\n\nWe recommend that you upgrade your ghostscript packages.\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 5.0 alias lenny\n- --------------------------------\n\nStable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4.diff.gz\n Size/MD5 checksum: 104592 c1f5f4ee971ea44f4b0cef7488fea58a\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny2.diff.gz\n Size/MD5 checksum: 104465 712a48aa6a1a28c2800ee3a950f24c93\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1.orig.tar.gz\n Size/MD5 checksum: 12212309 42fc1b31aa745c3765c2fcd2da243236\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/g/ghostscript/gs-gpl_8.62.dfsg.1-3.2lenny4_all.deb\n Size/MD5 checksum: 28702 dcf8382cede0279d2ced25016b5d63b0\n http://security.debian.org/pool/updates/main/g/ghostscript/gs-aladdin_8.62.dfsg.1-3.2lenny4_all.deb\n Size/MD5 checksum: 28704 a62393cb1d1449c44398279e40804a20\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-doc_8.62.dfsg.1-3.2lenny4_all.deb\n Size/MD5 checksum: 2784654 379db3cc220700a5320c0f3505ec6185\n http://security.debian.org/pool/updates/main/g/ghostscript/gs_8.62.dfsg.1-3.2lenny4_all.deb\n Size/MD5 checksum: 28692 f327874c01d90518ae69cc746ae8c245\n http://security.debian.org/pool/updates/main/g/ghostscript/gs-common_8.62.dfsg.1-3.2lenny4_all.deb\n Size/MD5 checksum: 28902 d790c6a598e425e86655613e3d842feb\n http://security.debian.org/pool/updates/main/g/ghostscript/gs-esp_8.62.dfsg.1-3.2lenny4_all.deb\n Size/MD5 checksum: 28696 6e1b2ffd61b41b2210c80035fa1c18d2\n\nalpha architecture (DEC Alpha)\n\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_alpha.deb\n Size/MD5 checksum: 66154 af55aa7bcd5471ef673c0c5f5fddf693\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_alpha.deb\n Size/MD5 checksum: 36444 e2e1d7dbf80456743f43c063ddd31d2a\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_alpha.deb\n Size/MD5 checksum: 797568 50220131de97010d530c84e4685b9ba3\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_alpha.deb\n Size/MD5 checksum: 2629590 bf6713489c1974a68e72244cd0ab313e\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_amd64.deb\n Size/MD5 checksum: 63102 b381fcd9f08a512ec234aefc4db55e6d\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_amd64.deb\n Size/MD5 checksum: 794264 1d6aa96ecda1cc3caaee6e02ec8131d0\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_amd64.deb\n Size/MD5 checksum: 36296 1c234970f6695e233c98f6c8b17a228d\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_amd64.deb\n Size/MD5 checksum: 2322612 ff18916f3e0b984520dc6a65a1850545\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_arm.deb\n Size/MD5 checksum: 59898 691db1eafdbb597550e41936a588dc2e\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_arm.deb\n Size/MD5 checksum: 2179214 fce17c2014ef0633694921ff7a2dbbf6\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_arm.deb\n Size/MD5 checksum: 34898 94bfb293db43933b96defcc65c2ce1e4\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_arm.deb\n Size/MD5 checksum: 796618 133283cd0ce5ad2ddfb180149dd1cdde\n\narmel architecture (ARM EABI)\n\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_armel.deb\n Size/MD5 checksum: 797658 bfee3d7ee43ecf42c762f707e15be417\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_armel.deb\n Size/MD5 checksum: 63604 ba4c4769c7a604e1cbd65e42d4a20308\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_armel.deb\n Size/MD5 checksum: 2214322 659428a1eb467fd459a8a10ac6e57f53\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_armel.deb\n Size/MD5 checksum: 36442 59d91a5b9a24bec78946a5e01345589b\n\nhppa architecture (HP PA RISC)\n\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_hppa.deb\n Size/MD5 checksum: 66854 e46caba3e0fc3e99c9d672210b414c85\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_hppa.deb\n Size/MD5 checksum: 2573688 98b1cb485944aeec0c762f4d3d6b5627\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_hppa.deb\n Size/MD5 checksum: 36330 5a36e8704d153f1c1269ddbe3d37368e\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_hppa.deb\n Size/MD5 checksum: 800058 3770d71e6644cf0bf82b5618c07879fe\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_i386.deb\n Size/MD5 checksum: 35476 2c35e644cc7bc6d5a29125de9bda777c\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_i386.deb\n Size/MD5 checksum: 2221692 263aab297fcd59829a0c5e0e2b0f1e6d\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_i386.deb\n Size/MD5 checksum: 761660 44c35e23d34cb081bb785c5a89683701\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_i386.deb\n Size/MD5 checksum: 60818 b150caecdd7fdd47538ac364b3a23baa\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_ia64.deb\n Size/MD5 checksum: 80902 c44a55178f56e171274891ff828be57c\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_ia64.deb\n Size/MD5 checksum: 36332 59188d6b794be8a8632f68c99e53fabe\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_ia64.deb\n Size/MD5 checksum: 3613878 b2037a5a573797ed7e8db63b25c54980\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_ia64.deb\n Size/MD5 checksum: 801702 f478ffb34fedecea724a6eff2c0c6aeb\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_mips.deb\n Size/MD5 checksum: 62840 1bf8443154d4ed4a3d7329078b16839f\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_mips.deb\n Size/MD5 checksum: 34916 965449e1371593ca5fdc0614c49f05ad\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_mips.deb\n Size/MD5 checksum: 798628 3673f32bc99ec26b919ad9a5a53742bc\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_mips.deb\n Size/MD5 checksum: 2304896 3713df01d5717a4d4af157cf0bb6fc88\n\nmipsel architecture (MIPS (Little Endian))\n\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_mipsel.deb\n Size/MD5 checksum: 35472 322427312d6cc997684dd4070f47e870\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_mipsel.deb\n Size/MD5 checksum: 61774 22a19e60d87c94a8bcaa931b13f20179\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_mipsel.deb\n Size/MD5 checksum: 762160 90c8fb7ba07e88329bb247ab49cf290f\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_mipsel.deb\n Size/MD5 checksum: 2300466 2d7ba5f0f3cc18775f25bbd3881bd5f4\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_powerpc.deb\n Size/MD5 checksum: 801086 eee24a6fc08a2e68405adc584d090819\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_powerpc.deb\n Size/MD5 checksum: 36432 4b62009ca227ff2aa28808ba5a696c02\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_powerpc.deb\n Size/MD5 checksum: 66012 ba51af4c986f7db06b66f7c3f3bef07e\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_powerpc.deb\n Size/MD5 checksum: 2408918 14806baf03b217ba15b6808493f4d46b\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_s390.deb\n Size/MD5 checksum: 36452 6a0cffde06a5f3fc635ac214fa874a94\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_s390.deb\n Size/MD5 checksum: 2437882 dd3fd6a06b07f8d45c9f07b339fe26dc\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_s390.deb\n Size/MD5 checksum: 64412 e60524ff7457eb9bf7a3430afcfba513\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_s390.deb\n Size/MD5 checksum: 800832 c91e9753ad83a76eebdf9abc7694f681\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs8_8.62.dfsg.1-3.2lenny4_sparc.deb\n Size/MD5 checksum: 2187340 476ff570ae6d30c7f881caba112b6e34\n http://security.debian.org/pool/updates/main/g/ghostscript/libgs-dev_8.62.dfsg.1-3.2lenny4_sparc.deb\n Size/MD5 checksum: 36350 4970f1e66a790e2a7b0aa4b285363c07\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript_8.62.dfsg.1-3.2lenny4_sparc.deb\n Size/MD5 checksum: 797876 f79742ddd68bee7476a39d4fde6ab68c\n http://security.debian.org/pool/updates/main/g/ghostscript/ghostscript-x_8.62.dfsg.1-3.2lenny4_sparc.deb\n Size/MD5 checksum: 59956 d7458a00b7f62c43b114aeff6deeec0c\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>", "cvss3": {}, "published": "2010-08-01T01:24:55", "type": "debian", "title": "[SECURITY] [DSA 2080-1] New ghostscript packages fix several vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-6725", "CVE-2008-3522", "CVE-2008-6679", "CVE-2009-0196", "CVE-2009-0792", "CVE-2009-4270", "CVE-2010-1869"], "modified": "2010-08-01T01:24:55", "id": "DEBIAN:DSA-2080-1:68D05", "href": "https://lists.debian.org/debian-security-announce/2010/msg00125.html", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}]}
[SECURITY] Fedora 10 Update: jasper-1.900.1-13.fc10
