The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3802-1 advisory.
Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl, pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a denial of service (application crash). (CVE-2018-20846)
OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.
(CVE-2018-21010)
A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of the user running such an application. (CVE-2020-27814)
A flaw was found in OpenJPEG’s encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest threat from this vulnerability is to system availability. (CVE-2020-27824)
There’s a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability. (CVE-2020-27841)
There’s a flaw in openjpeg’s t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability. (CVE-2020-27842)
A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability. (CVE-2020-27843)
There’s a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg’s conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability. (CVE-2020-27845)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# SUSE update advisory SUSE-SU-2022:3802-1. The text itself
# is copyright (C) SUSE.
##
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(166688);
script_version("1.8");
script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/13");
script_cve_id(
"CVE-2018-20846",
"CVE-2018-21010",
"CVE-2020-27814",
"CVE-2020-27824",
"CVE-2020-27841",
"CVE-2020-27842",
"CVE-2020-27843",
"CVE-2020-27845"
);
script_xref(name:"SuSE", value:"SUSE-SU-2022:3802-1");
script_xref(name:"CEA-ID", value:"CEA-2021-0025");
script_name(english:"SUSE SLED15 / SLES15 Security Update : openjpeg2 (SUSE-SU-2022:3802-1)");
script_set_attribute(attribute:"synopsis", value:
"The remote SUSE host is missing one or more security updates.");
script_set_attribute(attribute:"description", value:
"The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by
multiple vulnerabilities as referenced in the SUSE-SU-2022:3802-1 advisory.
- Out-of-bounds accesses in the functions pi_next_lrcp, pi_next_rlcp, pi_next_rpcl, pi_next_pcrl,
pi_next_rpcl, and pi_next_cprl in openmj2/pi.c in OpenJPEG through 2.3.0 allow remote attackers to cause a
denial of service (application crash). (CVE-2018-20846)
- OpenJPEG before 2.3.1 has a heap buffer overflow in color_apply_icc_profile in bin/common/color.c.
(CVE-2018-21010)
- A heap-buffer overflow was found in the way openjpeg2 handled certain PNG format files. An attacker could
use this flaw to cause an application crash or in some cases execute arbitrary code with the permission of
the user running such an application. (CVE-2020-27814)
- A flaw was found in OpenJPEG's encoder in the opj_dwt_calc_explicit_stepsizes() function. This flaw allows
an attacker who can supply crafted input to decomposition levels to cause a buffer overflow. The highest
threat from this vulnerability is to system availability. (CVE-2020-27824)
- There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to
provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The
greatest impact from this flaw is to application availability. (CVE-2020-27841)
- There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide
crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of
this flaw is to application availability. (CVE-2020-27842)
- A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially
crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest
threat from this vulnerability is system availability. (CVE-2020-27843)
- There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to
provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds
read. The highest impact of this flaw is to application availability. (CVE-2020-27845)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1140205");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1149789");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1179594");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1179821");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1180042");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1180043");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1180044");
script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1180046");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-20846");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2018-21010");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-27814");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-27824");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-27841");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-27842");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-27843");
script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2020-27845");
# https://lists.suse.com/pipermail/sle-security-updates/2022-October/012731.html
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8766b837");
script_set_attribute(attribute:"solution", value:
"Update the affected libopenjp2-7, openjpeg2 and / or openjpeg2-devel packages.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-27814");
script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2018-21010");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2019/06/26");
script_set_attribute(attribute:"patch_publication_date", value:"2022/10/27");
script_set_attribute(attribute:"plugin_publication_date", value:"2022/10/28");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libopenjp2-7");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openjpeg2");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:openjpeg2-devel");
script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"SuSE Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
exit(0);
}
include('rpm.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item("Host/SuSE/release");
if (isnull(os_release) || os_release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
var os_ver = pregmatch(pattern: "^(SLE(S|D)(?:_SAP)?\d+)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'SUSE');
os_ver = os_ver[1];
if (! preg(pattern:"^(SLED15|SLED_SAP15|SLES15|SLES_SAP15)$", string:os_ver)) audit(AUDIT_OS_NOT, 'SUSE SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15', 'SUSE (' + os_ver + ')');
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'SUSE (' + os_ver + ')', cpu);
var service_pack = get_kb_item("Host/SuSE/patchlevel");
if (isnull(service_pack)) service_pack = "0";
if (os_ver == "SLED15" && (! preg(pattern:"^(3)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLED15 SP3", os_ver + " SP" + service_pack);
if (os_ver == "SLED_SAP15" && (! preg(pattern:"^(3)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLED_SAP15 SP3", os_ver + " SP" + service_pack);
if (os_ver == "SLES15" && (! preg(pattern:"^(3)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLES15 SP3", os_ver + " SP" + service_pack);
if (os_ver == "SLES_SAP15" && (! preg(pattern:"^(2|3)$", string:service_pack))) audit(AUDIT_OS_NOT, "SLES_SAP15 SP2/3", os_ver + " SP" + service_pack);
var pkgs = [
{'reference':'libopenjp2-7-2.3.0-150000.3.8.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.2']},
{'reference':'openjpeg2-2.3.0-150000.3.8.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.2']},
{'reference':'openjpeg2-devel-2.3.0-150000.3.8.1', 'sp':'2', 'cpu':'x86_64', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.2']},
{'reference':'libopenjp2-7-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLED_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3']},
{'reference':'libopenjp2-7-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3']},
{'reference':'openjpeg2-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLED_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3']},
{'reference':'openjpeg2-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3']},
{'reference':'openjpeg2-devel-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLED_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3']},
{'reference':'openjpeg2-devel-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLES_SAP15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLES_SAP-release-15.3']},
{'reference':'libopenjp2-7-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']},
{'reference':'libopenjp2-7-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']},
{'reference':'openjpeg2-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']},
{'reference':'openjpeg2-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']},
{'reference':'openjpeg2-devel-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLED15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']},
{'reference':'openjpeg2-devel-2.3.0-150000.3.8.1', 'sp':'3', 'release':'SLES15', 'rpm_spec_vers_cmp':TRUE, 'exists_check':['SLE_HPC-release-15.3', 'sle-module-basesystem-release-15.3', 'sled-release-15.3', 'sles-release-15.3']}
];
var ltss_caveat_required = FALSE;
var flag = 0;
foreach var package_array ( pkgs ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var exists_check = NULL;
var rpm_spec_vers_cmp = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (reference && _release) {
if (exists_check) {
var check_flag = 0;
foreach var check (exists_check) {
if (!rpm_exists(release:_release, rpm:check)) continue;
check_flag++;
}
if (!check_flag) continue;
}
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_WARNING,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'libopenjp2-7 / openjpeg2 / openjpeg2-devel');
}
Vendor | Product | Version | CPE |
---|---|---|---|
novell | suse_linux | libopenjp2-7 | p-cpe:/a:novell:suse_linux:libopenjp2-7 |
novell | suse_linux | openjpeg2 | p-cpe:/a:novell:suse_linux:openjpeg2 |
novell | suse_linux | openjpeg2-devel | p-cpe:/a:novell:suse_linux:openjpeg2-devel |
novell | suse_linux | 15 | cpe:/o:novell:suse_linux:15 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20846
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21010
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27814
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27824
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27841
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27842
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27843
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27845
www.nessus.org/u?8766b837
bugzilla.suse.com/1140205
bugzilla.suse.com/1149789
bugzilla.suse.com/1179594
bugzilla.suse.com/1179821
bugzilla.suse.com/1180042
bugzilla.suse.com/1180043
bugzilla.suse.com/1180044
bugzilla.suse.com/1180046
www.suse.com/security/cve/CVE-2018-20846
www.suse.com/security/cve/CVE-2018-21010
www.suse.com/security/cve/CVE-2020-27814
www.suse.com/security/cve/CVE-2020-27824
www.suse.com/security/cve/CVE-2020-27841
www.suse.com/security/cve/CVE-2020-27842
www.suse.com/security/cve/CVE-2020-27843
www.suse.com/security/cve/CVE-2020-27845