The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.
jasper: heap-based buffer over-read of size 8 in jas_image_depalettize in libjasper/base/jas_image.c (CVE-2018-19541)
jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c (CVE-2020-27828)
The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence. (CVE-2016-10248)
Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.
(CVE-2016-10251)
Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137. (CVE-2016-1577)
The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out- of-bounds read and application crash) via a crafted JPEG 2000 image. (CVE-2016-1867)
The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image. (CVE-2016-2089)
Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file. (CVE-2016-2116)
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.
(CVE-2016-8690)
The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command. (CVE-2016-8691)
The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command. (CVE-2016-8692)
Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command. (CVE-2016-8693)
The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (CVE-2016-8883)
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image.
NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690. (CVE-2016-8884)
The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image. (CVE-2016-8885)
The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers to have unspecified impact via a crafted file, which triggers a memory allocation failure. (CVE-2016-8886)
Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of service via a crafted image, which triggers use after free vulnerabilities. (CVE-2016-9262)
Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13 allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion failure. (CVE-2016-9387)
The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (CVE-2016-9388)
The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause a denial of service (assertion failure). (CVE-2016-9389)
The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a denial of service (assertion failure) via a crafted image file. (CVE-2016-9390)
The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a denial of service (assertion failure) via a very large integer. (CVE-2016-9391)
The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (CVE-2016-9392)
The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (CVE-2016-9393)
The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (CVE-2016-9394)
The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a denial of service (assertion failure) via a crafted file. (CVE-2016-9395)
The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors. (CVE-2016-9396)
The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors. (CVE-2016-9397)
The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors. (CVE-2016-9398)
The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors. (CVE-2016-9399)
An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input. (CVE-2016-9583)
JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer. (CVE-2016-9591)
JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
(CVE-2016-9600)
There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack by triggering an unexpected jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154. (CVE-2017-13745)
There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13747)
There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in base/jas_string.c, that will lead to a remote denial of service attack. (CVE-2017-13748)
There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13749)
There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13751)
There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13752)
JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, related to the jas_image_ishomosamp function in libjasper/base/jas_image.c. (CVE-2017-14132)
The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image. (CVE-2017-5504)
The jas_matrix_bindsub function in jas_seq.c in JasPer 2.0.10 allows remote attackers to cause a denial of service (invalid read) via a crafted image. (CVE-2017-6851)
Heap-based buffer overflow in the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer 2.0.10 allows remote attackers to have unspecified impact via a crafted image. (CVE-2017-6852)
JasPer 2.0.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted image, related to the jp2_decode function in libjasper/jp2/jp2_dec.c.
(CVE-2017-9782)
An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function ras_putdatastd in ras/ras_enc.c. (CVE-2018-18873)
An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt in libjasper/base/jas_image.c, leading to a denial of service. (CVE-2018-19539)
An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer overflow of size 1 in the function jas_icctxtdesc_input in libjasper/base/jas_icc.c.
(CVE-2018-19540)
An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode in libjasper/jp2/jp2_dec.c, leading to a denial of service. (CVE-2018-19542)
An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function jp2_decode in libjasper/jp2/jp2_dec.c. (CVE-2018-19543)
JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in libjasper/jpc/jpc_math.c. (CVE-2018-9055)
JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in libjasper/jpc/jpc_enc.c. (CVE-2018-9252)
A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function whic may lead to disclosure of information or program crash. (CVE-2021-26926)
A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead to program crash and denial of service. (CVE-2021-26927)
jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is an invalid relationship between the number of channels and the number of image components. (CVE-2021-3272)
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened. (CVE-2021-3443)
A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an application using the Jasper library to crash when opened. (CVE-2021-3467)
JasPer 3.0.6 allows denial of service via a reachable assertion in the function inttobits in libjasper/base/jas_image.c. (CVE-2022-40755)
An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code. (CVE-2023-51257)
Note that Nessus has not tested for these issues but has instead relied on the package manager’s report that the package is installed.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory jasper. The text
# itself is copyright (C) Red Hat, Inc.
##
include('compat.inc');
if (description)
{
script_id(195467);
script_version("1.0");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/11");
script_cve_id(
"CVE-2016-1577",
"CVE-2016-1867",
"CVE-2016-2089",
"CVE-2016-2116",
"CVE-2016-8690",
"CVE-2016-8691",
"CVE-2016-8692",
"CVE-2016-8693",
"CVE-2016-8883",
"CVE-2016-8884",
"CVE-2016-8885",
"CVE-2016-8886",
"CVE-2016-9262",
"CVE-2016-9387",
"CVE-2016-9388",
"CVE-2016-9389",
"CVE-2016-9390",
"CVE-2016-9391",
"CVE-2016-9392",
"CVE-2016-9393",
"CVE-2016-9394",
"CVE-2016-9395",
"CVE-2016-9396",
"CVE-2016-9397",
"CVE-2016-9398",
"CVE-2016-9399",
"CVE-2016-9583",
"CVE-2016-9591",
"CVE-2016-9600",
"CVE-2016-10248",
"CVE-2016-10251",
"CVE-2017-5504",
"CVE-2017-6851",
"CVE-2017-6852",
"CVE-2017-9782",
"CVE-2017-13745",
"CVE-2017-13747",
"CVE-2017-13748",
"CVE-2017-13749",
"CVE-2017-13751",
"CVE-2017-13752",
"CVE-2017-14132",
"CVE-2018-9055",
"CVE-2018-9252",
"CVE-2018-18873",
"CVE-2018-19539",
"CVE-2018-19540",
"CVE-2018-19541",
"CVE-2018-19542",
"CVE-2018-19543",
"CVE-2020-27828",
"CVE-2021-3272",
"CVE-2021-3443",
"CVE-2021-3467",
"CVE-2021-26926",
"CVE-2021-26927",
"CVE-2022-40755",
"CVE-2023-51257"
);
script_name(english:"RHEL 7 : jasper (Unpatched Vulnerability)");
script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat 7 host is affected by multiple vulnerabilities that will not be patched.");
script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple
vulnerabilities that have been acknowledged by the vendor but will not be patched.
- jasper: heap-based buffer over-read of size 8 in jas_image_depalettize in libjasper/base/jas_image.c
(CVE-2018-19541)
- jasper: Heap-based buffer overflow in cp_create() in jpc_enc.c (CVE-2020-27828)
- The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a
denial of service (NULL pointer dereference) via vectors involving an empty sequence. (CVE-2016-10248)
- Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in JasPer before 1.900.20 allows remote
attackers to have unspecified impact via a crafted file, which triggers use of an uninitialized value.
(CVE-2016-10251)
- Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows
remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC
color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137. (CVE-2016-1577)
- The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out-
of-bounds read and application crash) via a crafted JPEG 2000 image. (CVE-2016-1867)
- The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of
service (invalid read and application crash) via a crafted JPEG 2000 image. (CVE-2016-2089)
- Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote
attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000
image file. (CVE-2016-2116)
- The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to
cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.
(CVE-2016-8690)
- The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote
attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz
value in a BMP image to the imginfo command. (CVE-2016-8691)
- The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote
attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz
value in a BMP image to the imginfo command. (CVE-2016-8692)
- Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows
remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP
image to the imginfo command. (CVE-2016-8693)
- The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a
denial of service (assertion failure) via a crafted file. (CVE-2016-8883)
- The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote attackers to cause a
denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP image.
NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8690. (CVE-2016-8884)
- The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.9 allows remote attackers to
cause a denial of service (NULL pointer dereference) by calling the imginfo command with a crafted BMP
image. (CVE-2016-8885)
- The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers
to have unspecified impact via a crafted file, which triggers a memory allocation failure. (CVE-2016-8886)
- Multiple integer overflows in the (1) jas_realloc function in base/jas_malloc.c and (2) mem_resize
function in base/jas_stream.c in JasPer before 1.900.22 allow remote attackers to cause a denial of
service via a crafted image, which triggers use after free vulnerabilities. (CVE-2016-9262)
- Integer overflow in the jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.13
allows remote attackers to have unspecified impact via a crafted file, which triggers an assertion
failure. (CVE-2016-9387)
- The ras_getcmap function in ras_dec.c in JasPer before 1.900.14 allows remote attackers to cause a denial
of service (assertion failure) via a crafted image file. (CVE-2016-9388)
- The jpc_irct and jpc_iict functions in jpc_mct.c in JasPer before 1.900.14 allow remote attackers to cause
a denial of service (assertion failure). (CVE-2016-9389)
- The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.14 allows remote attackers to cause a
denial of service (assertion failure) via a crafted image file. (CVE-2016-9390)
- The jpc_bitstream_getbits function in jpc_bs.c in JasPer before 2.0.10 allows remote attackers to cause a
denial of service (assertion failure) via a very large integer. (CVE-2016-9391)
- The calcstepsizes function in jpc_dec.c in JasPer before 1.900.17 allows remote attackers to cause a
denial of service (assertion failure) via a crafted file. (CVE-2016-9392)
- The jpc_pi_nextrpcl function in jpc_t2cod.c in JasPer before 1.900.17 allows remote attackers to cause a
denial of service (assertion failure) via a crafted file. (CVE-2016-9393)
- The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.17 allows remote attackers to cause a
denial of service (assertion failure) via a crafted file. (CVE-2016-9394)
- The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a
denial of service (assertion failure) via a crafted file. (CVE-2016-9395)
- The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause
a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors. (CVE-2016-9396)
- The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of
service (assertion failure) via unspecified vectors. (CVE-2016-9397)
- The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a
denial of service (assertion failure) via unspecified vectors. (CVE-2016-9398)
- The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of
service (assertion failure) via unspecified vectors. (CVE-2016-9399)
- An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before
2.0.6 when processing crafted input. (CVE-2016-9583)
- JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000
image files resulting in a crash on the application using JasPer. (CVE-2016-9591)
- JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation
of JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.
(CVE-2016-9600)
- There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer
2.0.12 that will lead to a remote denial of service attack by triggering an unexpected
jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154. (CVE-2017-13745)
- There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12
that will lead to a remote denial of service attack. (CVE-2017-13747)
- There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in
base/jas_string.c, that will lead to a remote denial of service attack. (CVE-2017-13748)
- There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12
that will lead to a remote denial of service attack. (CVE-2017-13749)
- There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12
that will lead to a remote denial of service attack. (CVE-2017-13751)
- There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12
that will lead to a remote denial of service attack. (CVE-2017-13752)
- JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17,
1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27,
1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8,
2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16 allows remote attackers to cause a denial of
service (heap-based buffer over-read and application crash) via a crafted image, related to the
jas_image_ishomosamp function in libjasper/base/jas_image.c. (CVE-2017-14132)
- The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a
denial of service (invalid memory read and crash) via a crafted image. (CVE-2017-5504)
- The jas_matrix_bindsub function in jas_seq.c in JasPer 2.0.10 allows remote attackers to cause a denial of
service (invalid read) via a crafted image. (CVE-2017-6851)
- Heap-based buffer overflow in the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer 2.0.10 allows remote
attackers to have unspecified impact via a crafted image. (CVE-2017-6852)
- JasPer 2.0.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and
application crash) via a crafted image, related to the jp2_decode function in libjasper/jp2/jp2_dec.c.
(CVE-2017-9782)
- An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function
ras_putdatastd in ras/ras_enc.c. (CVE-2018-18873)
- An issue was discovered in JasPer 2.0.14. There is an access violation in the function jas_image_readcmpt
in libjasper/base/jas_image.c, leading to a denial of service. (CVE-2018-19539)
- An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14,
1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24,
1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4,
2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a
heap-based buffer overflow of size 1 in the function jas_icctxtdesc_input in libjasper/base/jas_icc.c.
(CVE-2018-19540)
- An issue was discovered in JasPer 2.0.14. There is a NULL pointer dereference in the function jp2_decode
in libjasper/jp2/jp2_dec.c, leading to a denial of service. (CVE-2018-19542)
- An issue was discovered in JasPer 2.0.14. There is a heap-based buffer over-read of size 8 in the function
jp2_decode in libjasper/jp2/jp2_dec.c. (CVE-2018-19543)
- JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_firstone in
libjasper/jpc/jpc_math.c. (CVE-2018-9055)
- JasPer 2.0.14 allows denial of service via a reachable assertion in the function jpc_abstorelstepsize in
libjasper/jpc/jpc_enc.c. (CVE-2018-9252)
- A flaw was found in jasper before 2.0.25. An out of bounds read issue was found in jp2_decode function
whic may lead to disclosure of information or program crash. (CVE-2021-26926)
- A flaw was found in jasper before 2.0.25. A null pointer dereference in jp2_decode in jp2_dec.c may lead
to program crash and denial of service. (CVE-2021-26927)
- jp2_decode in jp2/jp2_dec.c in libjasper in JasPer 2.0.24 has a heap-based buffer over-read when there is
an invalid relationship between the number of channels and the number of image components. (CVE-2021-3272)
- A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.27 handled component
references in the JP2 image format decoder. A specially crafted JP2 image file could cause an application
using the Jasper library to crash when opened. (CVE-2021-3443)
- A NULL pointer dereference flaw was found in the way Jasper versions before 2.0.26 handled component
references in CDEF box in the JP2 image format decoder. A specially crafted JP2 image file could cause an
application using the Jasper library to crash when opened. (CVE-2021-3467)
- JasPer 3.0.6 allows denial of service via a reachable assertion in the function inttobits in
libjasper/base/jas_image.c. (CVE-2022-40755)
- An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to
execute arbitrary code. (CVE-2023-51257)
Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package
is installed.");
script_set_attribute(attribute:"solution", value:
"The vendor has acknowledged the vulnerabilities but no solution has been provided. Refer to the vendor for remediation
guidance.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-27828");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2018-19541");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vendor_unpatched", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/13");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/11");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:6");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:8");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:jasper");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mingw-jasper");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:mingw-virt-viewer");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:netpbm");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Red Hat Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
exit(0);
}
include('rpm.inc');
include('rhel.inc');
if (!get_kb_item("global_settings/vendor_unpatched"))
exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '7')) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);
if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);
var constraints = [
{
'pkgs': [
{'reference':'jasper', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'jasper', 'cves':['CVE-2016-8886', 'CVE-2016-9395', 'CVE-2016-9398', 'CVE-2016-9399', 'CVE-2017-5504', 'CVE-2017-6851', 'CVE-2017-6852', 'CVE-2017-9782', 'CVE-2017-13747', 'CVE-2017-13748', 'CVE-2017-13749', 'CVE-2017-13751', 'CVE-2018-9055', 'CVE-2018-9252', 'CVE-2018-18873', 'CVE-2018-19539', 'CVE-2018-19540', 'CVE-2018-19541', 'CVE-2018-19542', 'CVE-2018-19543', 'CVE-2020-27828', 'CVE-2021-3272', 'CVE-2021-3443', 'CVE-2021-3467', 'CVE-2021-26926', 'CVE-2021-26927', 'CVE-2022-40755', 'CVE-2023-51257']},
{'reference':'mingw-virt-viewer', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'mingw-virt-viewer', 'cves':['CVE-2016-1577', 'CVE-2016-1867', 'CVE-2016-2089', 'CVE-2016-2116', 'CVE-2016-8690', 'CVE-2016-8691', 'CVE-2016-8692', 'CVE-2016-8693', 'CVE-2016-8883', 'CVE-2016-8884', 'CVE-2016-8885', 'CVE-2016-8886', 'CVE-2016-9262', 'CVE-2016-9387', 'CVE-2016-9388', 'CVE-2016-9389', 'CVE-2016-9390', 'CVE-2016-9391', 'CVE-2016-9392', 'CVE-2016-9393', 'CVE-2016-9394', 'CVE-2016-9395', 'CVE-2016-9396', 'CVE-2016-9397', 'CVE-2016-9398', 'CVE-2016-9399', 'CVE-2016-9583', 'CVE-2016-9591', 'CVE-2016-9600', 'CVE-2016-10248', 'CVE-2016-10251', 'CVE-2017-5504', 'CVE-2017-6851', 'CVE-2017-6852', 'CVE-2017-9782', 'CVE-2017-13745', 'CVE-2017-13747', 'CVE-2017-13748', 'CVE-2017-13749', 'CVE-2017-13751', 'CVE-2017-13752', 'CVE-2017-14132', 'CVE-2018-9055', 'CVE-2018-9252']}
]
}
];
var flag = 0;
foreach var constraint_array ( constraints ) {
var repo_relative_urls = NULL;
var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);
foreach var pkg ( constraint_array['pkgs'] ) {
var unpatched_pkg = NULL;
var _release = NULL;
var sp = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var exists_check = NULL;
var cves = NULL;
if (!empty_or_null(pkg['unpatched_pkg'])) unpatched_pkg = pkg['unpatched_pkg'];
if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
if (unpatched_pkg &&
_release &&
(!exists_check || rpm_exists(release:_release, rpm:exists_check)) &&
unpatched_package_exists(release:_release, package:unpatched_pkg, cves: cves)) flag++;
}
}
if (flag)
{
var extra = NULL;
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : unpatched_packages_report()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'jasper / mingw-virt-viewer');
}
Vendor | Product | Version | CPE |
---|---|---|---|
redhat | enterprise_linux | 5 | cpe:/o:redhat:enterprise_linux:5 |
redhat | enterprise_linux | 6 | cpe:/o:redhat:enterprise_linux:6 |
redhat | enterprise_linux | 7 | cpe:/o:redhat:enterprise_linux:7 |
redhat | enterprise_linux | 8 | cpe:/o:redhat:enterprise_linux:8 |
redhat | enterprise_linux | jasper | p-cpe:/a:redhat:enterprise_linux:jasper |
redhat | enterprise_linux | mingw-jasper | p-cpe:/a:redhat:enterprise_linux:mingw-jasper |
redhat | enterprise_linux | mingw-virt-viewer | p-cpe:/a:redhat:enterprise_linux:mingw-virt-viewer |
redhat | enterprise_linux | netpbm | p-cpe:/a:redhat:enterprise_linux:netpbm |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10248
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10251
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1577
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1867
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2089
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2116
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8690
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8691
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8692
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8693
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8883
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8884
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8885
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8886
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9262
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9387
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9388
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9389
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9390
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9391
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9392
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9393
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9394
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9395
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9396
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9397
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9398
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9399
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9583
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9591
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9600
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13745
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13747
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13748
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13749
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13751
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13752
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14132
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5504
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6851
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6852
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9782
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18873
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19539
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19540
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19541
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19542
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19543
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9055
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9252
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27828
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26926
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26927
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3272
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3443
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3467
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40755
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-51257