Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jasper: incorrect component number check in COC, RGN and QCC marker segment decoders (oCERT-2014-009)     (CVE-2014-9029)

  - netpbm: Out-of-bounds write in writeRasterPbm() function (CVE-2017-2581)

  - Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote     attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000     file. (CVE-2014-8138)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Bump release

  - Multiple security fixes (fixed by thoger): CVE-2015-5203     CVE-2015-5221 CVE-2016-1577 CVE-2016-1867     (CVE-2016-2089) CVE-2016-2116 CVE-2016-8654     CVE-2016-8690 CVE-2016-8691 (CVE-2016-8692)     CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885     (CVE-2016-9262) CVE-2016-9387 CVE-2016-9388     CVE-2016-9389 CVE-2016-9390 (CVE-2016-9391)     CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560     (CVE-2016-9583) CVE-2016-9591 CVE-2016-9600     CVE-2016-10248 CVE-2016-10249 (CVE-2016-10251)

  - Fix implicit declaration warning caused by security     fixes above

  - CVE-2014-8157 - dec->numtiles off-by-one check in     jpc_dec_process_sot (#1183672)

  - CVE-2014-8158 - unrestricted stack memory use in     jpc_qmfb.c (#1183680)

  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy     (#1173567)

  - CVE-2014-8138 - heap overflow in jp2_decode (#1173567)

  - CVE-2014-9029 - incorrect component number check in COC,     RGN and QCC marker segment decoders (#1171209)

This update for jasper to version 1.900.14 fixes several issues.

These security issues were fixed :

  - CVE-2008-3522: Buffer overflow in the jas_stream_printf     function in libjasper/base/jas_stream.c in JasPer might     have allowed context-dependent attackers to have an     unknown impact via vectors related to the mif_hdr_put     function and use of vsprintf (bsc#392410)

  - CVE-2015-5203: Double free corruption in JasPer     JPEG-2000 implementation (bsc#941919).

  - CVE-2015-5221: Use-after-free (and double-free) in     Jasper JPEG-200 (bsc#942553).

  - CVE-2016-1577: Double free vulnerability in the     jas_iccattrval_destroy function in JasPer allowed remote     attackers to cause a denial of service (crash) or     possibly execute arbitrary code via a crafted ICC color     profile in a JPEG 2000 image file, a different     vulnerability than CVE-2014-8137 (bsc#968373).

  - CVE-2016-2116: Memory leak in the     jas_iccprof_createfrombuf function in JasPer allowed     remote attackers to cause a denial of service (memory     consumption) via a crafted ICC color profile in a JPEG     2000 image file (bsc#968373)

  - CVE-2016-8690: NULL pointer dereference in bmp_getdata     triggered by crafted BMP image (bsc#1005084).

  - CVE-2016-8691, CVE-2016-8692: Missing range check on     XRsiz and YRsiz fields of SIZ marker segment     (bsc#1005090).

  - CVE-2016-8693: The memory stream interface allowed for a     buffer size of zero. The case of a zero-sized buffer was     not handled correctly, as it could lead to a double free     (bsc#1005242).

  - CVE-2016-8880: Heap overflow in jpc_dec_cp_setfromcox()     (bsc#1006591).

  - CVE-2016-8881: Heap overflow in jpc_getuint16()     (bsc#1006593).

  - CVE-2016-8882: NULL pointer access in jpc_pi_destroy     (bsc#1006597).

  - CVE-2016-8883: Assert triggered in jpc_dec_tiledecode()     (bsc#1006598).

  - CVE-2016-8886: Memory allocation failure in jas_malloc     (jas_malloc.c) (bsc#1006599).

    For additional change description please have a look at     the changelog.

oCERT reports :

The library is affected by a double-free vulnerability in function jas_iccattrval_destroy() as well as a heap-based buffer overflow in function jp2_decode(). A specially crafted jp2 file can be used to trigger the vulnerabilities.

oCERT reports :

The library is affected by an off-by-one error in a buffer boundary check in jpc_dec_process_sot(), leading to a heap based buffer overflow, as well as multiple unrestricted stack memory use issues in jpc_qmfb.c, leading to stack overflow. A specially crafted jp2 file can be used to trigger the vulnerabilities.

oCERT reports :

Multiple off-by-one flaws, leading to heap-based buffer overflows, were found in the way JasPer decoded JPEG 2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code.

limingxing reports :

A vulnerability was found in the way the JasPer's jas_matrix_clip() function parses certain JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash.

New jasper packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

jasper was updated to fix two security issues.

These security issues were fixed :

  - CVE-2014-8157: Off-by-one error in the     jpc_dec_process_sot function in JasPer 1.900.1 and     earlier allowed remote attackers to cause a denial of     service (crash) or possibly execute arbitrary code via a     crafted JPEG 2000 image, which triggers a heap-based     buffer overflow (bnc#911837). CVE-2014-8158: Multiple     stack-based buffer overflows in jpc_qmfb.c in JasPer     1.900.1 and earlier allowed remote attackers to cause a     denial of service (crash) or possibly execute arbitrary     code via a crafted JPEG 2000 image (bnc#911837).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated jasper packages fix security vulnerabilities :

Josh Duart of the Google Security Team discovered heap-based buffer overflow flaws in JasPer, which could lead to denial of service (application crash) or the execution of arbitrary code (CVE-2014-9029).

A double free flaw was found in the way JasPer parsed ICC color profiles in JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code (CVE-2014-8137).

A heap-based buffer overflow flaw was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code (CVE-2014-8138).

An off-by-one flaw, leading to a heap-based buffer overflow, was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code (CVE-2014-8157).

An unrestricted stack memory use flaw was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code (CVE-2014-8158).

An off-by-one flaw, leading to a heap-based buffer overflow (CVE-2014-8157), and an unrestricted stack memory use flaw (CVE-2014-8158) were found in JasPer, a library for manipulating JPEG-2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated rhevm-spice-client packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Virtualization Manager 3.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Enterprise Virtualization Manager provides access to virtual machines using SPICE. These SPICE client packages provide the SPICE client and usbclerk service for both Windows 32-bit operating systems and Windows 64-bit operating systems.

This update adds support for the TLS Fallback Signaling Cipher Suite Value (TLS_FALLBACK_SCSV), which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol version fails.

This can prevent a forceful downgrade of the communication to SSL 3.0.
The SSL 3.0 protocol was found to be vulnerable to the padding oracle attack when using block cipher suites in cipher block chaining (CBC) mode. This issue is identified as CVE-2014-3566, and also known under the alias POODLE. This SSL 3.0 protocol flaw will not be addressed in a future update; it is recommended that users configure their applications to require at least TLS protocol version 1.0 for secure communication.

For additional information about this flaw, see the Knowledgebase article at https://access.redhat.com/articles/1232123

Multiple flaws were found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8138, CVE-2014-8157, CVE-2014-8158, CVE-2014-9029, CVE-2014-8137, CVE-2011-4516, CVE-2011-4517, CVE-2008-3520, CVE-2008-3522)

Red Hat would like to thank oCERT for reporting CVE-2014-8137, CVE-2014-8138, CVE-2014-8157, CVE-2014-8158, CVE-2014-9029, CVE-2011-4516, and CVE-2011-4517. oCERT acknowledges Jose Duart of the Google Security Team as the original reporter of CVE-2014-8137 and CVE-2014-8138; and pyddeh as the original reporter of CVE-2014-8157 and CVE-2014-8158.

The mingw-openssl and mingw-jasper packages have been upgraded to the latest upstream version, which provides a number of bug fixes and enhancements over the previous version. (BZ#1187585)

This update also fixes the following bugs :

* Previously, a guest system installed with tools incorrectly always started in full screen mode, even when the 'Open in Full Screen' option was unchecked in console options. Now, when connecting in window mode with the option unchecked, the guest system starts in a window as expected. (BZ#1172126)

* Prior to this update, copying and pasting of images from the client to the guest did not work when spice-gtk was built from upstream. Now, images can be copied and pasted without problems. (BZ#1187270)

In addition, this update adds the following enhancement :

* Administrators now have the option of automatic multiuser installation of virt-viewer onto many client workstations.
(BZ#1187272)

All rhevm-spice-client users are advised to upgrade to these updated packages, which correct these issues and add these enhancement.

The remote host is affected by the vulnerability described in GLSA-201503-01 (JasPer: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in JasPer. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted file       using JasPer, possibly resulting in execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

An off-by-one flaw, leading to a heap-based buffer overflow, was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8157)

An unrestricted stack memory use flaw was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8158)

This update for jasper fixes the following security issues :

  - Double free in jas_iccattrval_destroy(). Double call to     free() allowed attackers to cause a denial of service or     possibly have unspecified other impact via unknown     vectors. (bsc#909474). (CVE-2014-8137)

  - Heap overflow in jas_decode(). This could be used to do     an arbitrary write and could result in arbitrary code     execution. (bsc#909475). (CVE-2014-8138)

  - Off-by-one error in the jpc_dec_process_sot(). Could     allow remote attackers to cause a denial of service     (crash) or possibly execute arbitrary code via a crafted     JPEG 2000 image, which triggers a heap-based buffer     overflow. (bsc#911837). (CVE-2014-8157)

  - Multiple stack-based buffer overflows in jpc_qmfb.c.
    Could allow remote attackers to cause a denial of     service (crash) or possibly execute arbitrary code via a     crafted JPEG 2000 image. (bsc#911837). (CVE-2014-8158)

Updated jasper packages fix security vulnerabilities :

An off-by-one flaw, leading to a heap-based buffer overflow, was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code (CVE-2014-8157).

An unrestricted stack memory use flaw was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code (CVE-2014-8158).

This update fixes two security flaws in jasper.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues :

  - CVE-2014-8157, CVE-2014-8158: use after free and OOB     vulnerabilities (bnc#911837)

Fixes for CVE-2014-8157 and CVE-2014-8158

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-2483-1 fixed vulnerabilities in JasPer. This update provides the corresponding fix for the JasPer library embedded in the Ghostscript package.

Jose Duart discovered that JasPer incorrectly handled ICC color profiles in JPEG-2000 image files. If a user were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash or possibly execute arbitrary code with user privileges. (CVE-2014-8137)

Jose Duart discovered that JasPer incorrectly decoded certain malformed JPEG-2000 image files. If a user were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash or possibly execute arbitrary code with user privileges.
(CVE-2014-8138)

It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash or possibly execute arbitrary code with user privileges. (CVE-2014-8157)

It was discovered that JasPer incorrectly handled memory when processing JPEG-2000 image files. If a user were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause JasPer to crash or possibly execute arbitrary code with user privileges.
(CVE-2014-8158).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2483-1 advisory.

    Jose Duart discovered that JasPer incorrectly handled ICC color profiles in JPEG-2000 image files. If a     user were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause     JasPer to crash or possibly execute arbitrary code with user privileges. (CVE-2014-8137)

    Jose Duart discovered that JasPer incorrectly decoded certain malformed JPEG-2000 image files. If a user     were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause JasPer     to crash or possibly execute arbitrary code with user privileges. (CVE-2014-8138)

    It was discovered that JasPer incorrectly handled certain malformed JPEG-2000 image files. If a user were     tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause JasPer to     crash or possibly execute arbitrary code with user privileges. (CVE-2014-8157)

    It was discovered that JasPer incorrectly handled memory when processing JPEG-2000 image files. If a user     were tricked into opening a specially crafted JPEG-2000 image file, a remote attacker could cause JasPer     to crash or possibly execute arbitrary code with user privileges. (CVE-2014-8158)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2014-8157 - dec->numtiles off-by-one check in     jpc_dec_process_sot (#1183671)

  - CVE-2014-8158 - unrestricted stack memory use in     jpc_qmfb.c (#1183679)

  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy     (#1173566)

  - CVE-2014-8138 - heap overflow in jp2_decode (#1173566)

  - CVE-2014-9029 - incorrect component number check in COC,     RGN and QCC marker segment decoders (#1171208)

An off-by-one flaw, leading to a heap-based buffer overflow (CVE-2014-8157 ), and an unrestricted stack memory use flaw (CVE-2014-8158 ) were found in JasPer, a library for manipulating JPEG-2000 files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code.

Updated jasper packages that fix two security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

JasPer is an implementation of Part 1 of the JPEG 2000 image compression standard.

An off-by-one flaw, leading to a heap-based buffer overflow, was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8157)

An unrestricted stack memory use flaw was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8158)

Red Hat would like to thank oCERT for reporting these issues. oCERT acknowledges pyddeh as the original reporter.

All JasPer users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All applications using the JasPer libraries must be restarted for the update to take effect.

An off-by-one flaw, leading to a heap-based buffer overflow, was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8157)

An unrestricted stack memory use flaw was found in the way JasPer decoded JPEG 2000 image files. A specially crafted file could cause an application using JasPer to crash or, possibly, execute arbitrary code. (CVE-2014-8158)

All applications using the JasPer libraries must be restarted for the update to take effect.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-0074 advisory.

    - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183671)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199301	RHEL 5 : netpbm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
100116	OracleVM 3.3 / 3.4 : jasper (OVMSA-2017-0102)	Nessus	OracleVM Local Security Checks	high
94601	openSUSE Security Update : jasper (openSUSE-2016-1270)	Nessus	SuSE Local Security Checks	high
88875	FreeBSD : jasper -- multiple vulnerabilities (006e3b7c-d7d7-11e5-b85f-0018fe623f2b)	Nessus	FreeBSD Local Security Checks	medium
86663	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : jasper (SSA:2015-302-02)	Nessus	Slackware Local Security Checks	critical
83681	SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2015:0288-1)	Nessus	SuSE Local Security Checks	high
82412	Mandriva Linux Security Advisory : jasper (MDVSA-2015:159)	Nessus	Mandriva Local Security Checks	high
82121	Debian DLA-138-1 : jasper security update	Nessus	Debian Local Security Checks	high
81969	RHEL 6 : rhevm-spice-client (RHSA-2015:0698) (POODLE)	Nessus	Red Hat Local Security Checks	low
81686	GLSA-201503-01 : JasPer: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
81325	Amazon Linux AMI : jasper (ALAS-2015-479)	Nessus	Amazon Linux Local Security Checks	high
81311	SuSE 11.3 Security Update : jasper (SAT Patch Number 10261)	Nessus	SuSE Local Security Checks	high
81234	Mandriva Linux Security Advisory : jasper (MDVSA-2015:034)	Nessus	Mandriva Local Security Checks	high
81213	Fedora 20 : jasper-1.900.1-28.fc20 (2015-1159)	Nessus	Fedora Local Security Checks	high
81212	Fedora 21 : jasper-1.900.1-30.fc21 (2015-1062)	Nessus	Fedora Local Security Checks	high
81155	openSUSE Security Update : jasper (openSUSE-SU-2015:0200-1)	Nessus	SuSE Local Security Checks	high
81133	Fedora 20 : mingw-jasper-1.900.1-26.fc20 (2015-1125)	Nessus	Fedora Local Security Checks	high
81132	Fedora 21 : mingw-jasper-1.900.1-26.fc21 (2015-1068)	Nessus	Fedora Local Security Checks	high
81018	Ubuntu 10.04 LTS : ghostscript vulnerabilities (USN-2483-2)	Nessus	Ubuntu Local Security Checks	high
81017	Ubuntu 14.04 LTS : JasPer vulnerabilities (USN-2483-1)	Nessus	Ubuntu Local Security Checks	high
81012	OracleVM 3.3 : jasper (OVMSA-2015-0006)	Nessus	OracleVM Local Security Checks	high
80973	Debian DSA-3138-1 : jasper - security update	Nessus	Debian Local Security Checks	high
80969	CentOS 6 / 7 : jasper (CESA-2015:0074)	Nessus	CentOS Local Security Checks	high
80933	Scientific Linux Security Update : jasper on SL6.x, SL7.x i386/x86_64 (20150122)	Nessus	Scientific Linux Local Security Checks	high
80930	RHEL 6 / 7 : jasper (RHSA-2015:0074)	Nessus	Red Hat Local Security Checks	high
80927	Oracle Linux 6 / 7 : jasper (ELSA-2015-0074)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2014-8157

high

Tenable Plugins

high

high

high

medium

critical

high

high

high

low

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high