The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a denial of service (assertion failure) via unspecified vectors.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jasper: heap-based buffer over-read of size 8 in jas_image_depalettize in libjasper/base/jas_image.c     (CVE-2018-19541)

  - jasper: heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2018-19543)

  - The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers     to have unspecified impact via a crafted file, which triggers a memory allocation failure. (CVE-2016-8886)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jasper: heap-based buffer over-read of size 8 in jas_image_depalettize in libjasper/base/jas_image.c     (CVE-2018-19541)

  - jasper: heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2018-19543)

  - The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers     to have unspecified impact via a crafted file, which triggers a memory allocation failure. (CVE-2016-8886)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jasper: Out of bounds heap read in jpc_dec_decodepkt (CVE-2017-6852)

  - The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers     to have unspecified impact via a crafted file, which triggers a memory allocation failure. (CVE-2016-8886)

  - The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a     denial of service (assertion failure) via a crafted file. (CVE-2016-9395)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-0a6290f865 advisory.

  - The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause     a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors. (CVE-2016-9396)

  - The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of     service (assertion failure) via unspecified vectors. (CVE-2016-9397)

  - The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified vectors. (CVE-2016-9398)

  - The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of     service (assertion failure) via unspecified vectors. (CVE-2016-9399)

  - There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer     2.0.12 that will lead to a remote denial of service attack by triggering an unexpected     jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154. (CVE-2017-13745)

  - There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer     2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13746)

  - There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13747)

  - There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in     base/jas_string.c, that will lead to a remote denial of service attack. (CVE-2017-13748)

  - There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13749)

  - There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer     2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13750)

  - There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13751)

  - There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13752)

  - JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17,     1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27,     1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8,     2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16 allows remote attackers to cause a denial of     service (heap-based buffer over-read and application crash) via a crafted image, related to the     jas_image_ishomosamp function in libjasper/base/jas_image.c. (CVE-2017-14132)

  - JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check     to see if the image contained at least one component resulting in a denial-of-service. (CVE-2017-1000050)

  - There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an     attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality,     integrity, or application availability. (CVE-2020-27828)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-2b151590d9 advisory.

  - The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in JasPer through 2.0.12 allows remote attackers to cause     a denial of service (JPC_COX_RFT assertion failure) via unspecified vectors. (CVE-2016-9396)

  - The jpc_dequantize function in jpc_dec.c in JasPer 1.900.13 allows remote attackers to cause a denial of     service (assertion failure) via unspecified vectors. (CVE-2016-9397)

  - The jpc_floorlog2 function in jpc_math.c in JasPer before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified vectors. (CVE-2016-9398)

  - The calcstepsizes function in jpc_dec.c in JasPer 1.900.22 allows remote attackers to cause a denial of     service (assertion failure) via unspecified vectors. (CVE-2016-9399)

  - There is a reachable assertion abort in the function jpc_dec_process_sot() in jpc/jpc_dec.c in JasPer     2.0.12 that will lead to a remote denial of service attack by triggering an unexpected     jpc_ppmstabtostreams return value, a different vulnerability than CVE-2018-9154. (CVE-2017-13745)

  - There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1297 in JasPer     2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13746)

  - There is a reachable assertion abort in the function jpc_floorlog2() in jpc/jpc_math.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13747)

  - There are lots of memory leaks in JasPer 2.0.12, triggered in the function jas_strdup() in     base/jas_string.c, that will lead to a remote denial of service attack. (CVE-2017-13748)

  - There is a reachable assertion abort in the function jpc_pi_nextrpcl() in jpc/jpc_t2cod.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13749)

  - There is a reachable assertion abort in the function jpc_dec_process_siz() in jpc/jpc_dec.c:1296 in JasPer     2.0.12 that will lead to a remote denial of service attack. (CVE-2017-13750)

  - There is a reachable assertion abort in the function calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13751)

  - There is a reachable assertion abort in the function jpc_dequantize() in jpc/jpc_dec.c in JasPer 2.0.12     that will lead to a remote denial of service attack. (CVE-2017-13752)

  - JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17,     1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27,     1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8,     2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16 allows remote attackers to cause a denial of     service (heap-based buffer over-read and application crash) via a crafted image, related to the     jas_image_ishomosamp function in libjasper/base/jas_image.c. (CVE-2017-14132)

  - JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check     to see if the image contained at least one component resulting in a denial-of-service. (CVE-2017-1000050)

  - There's a flaw in jasper's jpc encoder in versions prior to 2.0.23. Crafted input provided to jasper by an     attacker could cause an arbitrary out-of-bounds write. This could potentially affect data confidentiality,     integrity, or application availability. (CVE-2020-27828)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for jasper fixes the following issues :

CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).

CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).

CVE-2017-5499: Validate component depth bit (bsc#1020451).

CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).

CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).

CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).

CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).

CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).

CVE-2018-18873: Fix NULL pointer deref in ras_putdatastd (bsc#1114498).

CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).

CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).

CVE-2018-20570: Fix heap-based buffer over-read in jp2_encode (bsc#1120807).

CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues :

CVE-2016-9398: Improved patch for already fixed issue (bsc#1010979).

CVE-2016-9399: Fix assert in calcstepsizes (bsc#1010980).

CVE-2016-9397: Fix assert in jpc_dequantize (bsc#1010786).

CVE-2016-9557: Fix signed integer overflow (bsc#1011829).

CVE-2017-5499: Validate component depth bit (bsc#1020451).

CVE-2017-5503: Check bounds in jas_seq2d_bindsub() (bsc#1020456).

CVE-2017-5504: Check bounds in jas_seq2d_bindsub() (bsc#1020458).

CVE-2017-5505: Check bounds in jas_seq2d_bindsub() (bsc#1020460).

CVE-2017-14132: Fix heap base overflow in by checking components (bsc#1057152).

CVE-2018-9154: Fixed a potential denial of service in jpc_dec_process_sot() (bsc#1092115).

CVE-2018-9252: Fix reachable assertion in jpc_abstorelstepsize (bsc#1088278).

CVE-2018-18873: Fix NULL pointer deref in ras_putdatastd (bsc#1114498).

CVE-2018-19139: Fix mem leaks by registering jpc_unk_destroyparms (bsc#1115637).

CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans mixup (bsc#1117328).

CVE-2018-20570: Fix heap-based buffer over-read in jp2_encode (bsc#1120807).

CVE-2018-20622: Fix memory leak in jas_malloc.c (bsc#1120805).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues :

  - CVE-2016-9398: Improved patch for already fixed issue     (bsc#1010979).

  - CVE-2016-9399: Fix assert in calcstepsizes     (bsc#1010980).

  - CVE-2017-5499: Validate component depth bit     (bsc#1020451).

  - CVE-2017-5503: Check bounds in jas_seq2d_bindsub()     (bsc#1020456).

  - CVE-2017-5504: Check bounds in jas_seq2d_bindsub()     (bsc#1020458).

  - CVE-2017-5505: Check bounds in jas_seq2d_bindsub()     (bsc#1020460).

  - CVE-2017-14132: Fix heap base overflow in by checking     components (bsc#1057152).

  - CVE-2018-9252: Fix reachable assertion in     jpc_abstorelstepsize (bsc#1088278).

  - CVE-2018-18873: Fix NULL pointer deref in ras_putdatastd     (bsc#1114498).

  - CVE-2018-19139: Fix mem leaks by registering     jpc_unk_destroyparms (bsc#1115637).

  - CVE-2018-19543, bsc#1045450 CVE-2017-9782: Fix numchans     mixup (bsc#1117328).

  - CVE-2018-20570: Fix heap based buffer over-read in     jp2_encode (bsc#1120807).

  - CVE-2018-20622: Fix memory leak in jas_malloc.c     (bsc#1120805).

This update was imported from the SUSE:SLE-15:Update update project.

JasPer NEWS :

- Fix CVE-2018-9154

- Fix CVE-2018-19541

- Fix CVE-2016-9399, CVE-2017-13751

- Fix CVE-2018-19540

- Fix CVE-2018-9055

- Fix CVE-2017-13748

- Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505

- Fix CVE-2018-9252

- Fix CVE-2018-19139

- Fix CVE-2018-19543, CVE-2017-9782

- Fix CVE-2018-20570

- Fix CVE-2018-20622

- Fix CVE-2016-9398

- Fix CVE-2017-14132

- Fix CVE-2017-5499

- Fix CVE-2018-18873

- Fix CVE-2017-13750

According to the versions of the jasper package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Runtime libraries for jasper. Security Fix(es):Race     condition in the jas_stream_tmpfile function in     libjasper/base/jas_stream.c in JasPer 1.900.1 allows     local users to cause a denial of service (program exit)     by creating the appropriate tmp.XXXXXXXXXX temporary     file, which causes Jasper to exit. NOTE: this was     originally reported as a symlink issue, but this was     incorrect. NOTE: some vendors dispute the severity of     this issue, but it satisfies CVE's requirements for     inclusion.(CVE-2008-3521)Heap-based buffer overflow in     the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer     2.0.10 allows remote attackers to have unspecified     impact via a crafted image.(CVE-2017-6852)The     jp2_colr_destroy function in jp2_cod.c in JasPer before     1.900.13 allows remote attackers to cause a denial of     service (NULL pointer dereference) by leveraging     incorrect cleanup of JP2 box data on error. NOTE: this     vulnerability exists because of an incomplete fix for     CVE-2016-8887.(CVE-2016-10250)The jp2_cdef_destroy     function in jp2_cod.c in JasPer before 2.0.13 allows     remote attackers to cause a denial of service (NULL     pointer dereference) via a crafted     image.(CVE-2017-6850)The jp2_colr_destroy function in     libjasper/jp2/jp2_cod.c in JasPer before 1.900.10     allows remote attackers to cause a denial of service     (NULL pointer dereference).(CVE-2016-8887)The     jpc_floorlog2 function in jpc_math.c in JasPer before     1.900.17 allows remote attackers to cause a denial of     service (assertion failure) via unspecified     vectors.(CVE-2016-9398)JasPer 2.0.12 is vulnerable to a     NULL pointer exception in the function jp2_encode which     failed to check to see if the image contained at least     one component resulting in a     denial-of-service.(CVE-2017-1000050)The jpc_pi_nextrpcl     function in jpc_t2cod.c in JasPer before 1.900.17     allows remote attackers to cause a denial of service     (assertion failure) via a crafted     file.(CVE-2016-9393)The bmp_getdata function in     libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote     attackers to cause a denial of service (NULL pointer     dereference) by calling the imginfo command with a     crafted BMP image. NOTE: this vulnerability exists     because of an incomplete fix for     CVE-2016-8690.(CVE-2016-8884)There is a reachable     assertion abort in the function jpc_dequantize() in     jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a     remote denial of service attack.(CVE-2017-13752)The     jpc_dequantize function in jpc_dec.c in JasPer 1.900.13     allows remote attackers to cause a denial of service     (assertion failure) via unspecified     vectors.(CVE-2016-9397)There is a reachable assertion     abort in the function jpc_floorlog2() in jpc/jpc_math.c     in JasPer 2.0.12 that will lead to a remote denial of     service attack.(CVE-2017-13747)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer overflow of size 1 in the function     jas_icctxtdesc_input in     libjasper/base/jas_icc.c.(CVE-2018-19540)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer over-read of size 8 in the function     jas_image_depalettize in     libjasper/base/jas_image.c.(CVE-2018-19541)

  - An issue was discovered in JasPer 2.0.14. There is a     NULL pointer dereference in the function jp2_decode in     libjasper/jp2/jp2_dec.c, leading to a denial of     service.(CVE-2018-19542)

  - An issue was discovered in JasPer 2.0.14. There is an     access violation in the function jas_image_readcmpt in     libjasper/base/jas_image.c, leading to a denial of     service.(CVE-2018-19539)

  - Heap-based buffer overflow in the jpc_dec_decodepkt     function in jpc_t2dec.c in JasPer 2.0.10 allows remote     attackers to have unspecified impact via a crafted     image.(CVE-2017-6852)

  - JasPer 2.0.14 allows denial of service via a reachable     assertion in the function jpc_firstone in     libjasper/jpc/jpc_math.c.(CVE-2018-9055)

  - The jpc_floorlog2 function in jpc_math.c in JasPer     before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified     vectors.(CVE-2016-9398)

  - There are lots of memory leaks in JasPer 2.0.12,     triggered in the function jas_strdup() in     base/jas_string.c, that will lead to a remote denial of     service attack.(CVE-2017-13748)

  - There is a reachable assertion abort in the function     calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that     will lead to a remote denial of service     attack.(CVE-2017-13751)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The jpc_floorlog2 function in jpc_math.c in JasPer     before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified     vectors.(CVE-2016-9398)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The jpc_floorlog2 function in jpc_math.c in JasPer     before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified     vectors.(CVE-2016-9398)

  - JasPer 2.0.14 allows denial of service via a reachable     assertion in the function jpc_firstone in     libjasper/jpc/jpc_math.c.(CVE-2018-9055)

  - An issue was discovered in JasPer 2.0.14. There is an     access violation in the function jas_image_readcmpt in     libjasper/base/jas_image.c, leading to a denial of     service.(CVE-2018-19539)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer overflow of size 1 in the function     jas_icctxtdesc_input in     libjasper/base/jas_icc.c.(CVE-2018-19540)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer over-read of size 8 in the function     jas_image_depalettize in     libjasper/base/jas_image.c.(CVE-2018-19541)

  - An issue was discovered in JasPer 2.0.14. There is a     NULL pointer dereference in the function jp2_decode in     libjasper/jp2/jp2_dec.c, leading to a denial of     service.(CVE-2018-19542)

  - There are lots of memory leaks in JasPer 2.0.12,     triggered in the function jas_strdup() in     base/jas_string.c, that will lead to a remote denial of     service attack.(CVE-2017-13748)

  - There is a reachable assertion abort in the function     calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that     will lead to a remote denial of service     attack.(CVE-2017-13751)

  - Heap-based buffer overflow in the jpc_dec_decodepkt     function in jpc_t2dec.c in JasPer 2.0.10 allows remote     attackers to have unspecified impact via a crafted     image.(CVE-2017-6852)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues: Security issues fixed :

  - CVE-2016-8654: Heap-based buffer overflow in QMFB code     in JPC codec (bsc#1012530)

  - CVE-2016-9395: Missing sanity checks on the data in a     SIZ marker segment (bsc#1010977).

  - CVE-2016-9398: jpc_math.c:94: int jpc_floorlog2(int):
    Assertion 'x > 0' failed. (bsc#1010979)

  - CVE-2016-9560: stack-based buffer overflow in     jpc_tsfb_getbands2 (jpc_tsfb.c) (bsc#1011830)

  - CVE-2016-9583: Out of bounds heap read in     jpc_pi_nextpcrl() (bsc#1015400)

  - CVE-2016-9591: Use-after-free on heap in     jas_matrix_destroy (bsc#1015993)

  - CVE-2016-9600: NULL pointer Dereference due to missing     check for UNKNOWN color space in JP2 encoder     (bsc#1018088)

  - CVE-2016-10251: Use of uninitialized value in     jpc_pi_nextcprl (jpc_t2cod.c) (bsc#1029497)

  - CVE-2017-5498: left-shift undefined behaviour     (bsc#1020353)

  - CVE-2017-6850: NULL pointer dereference in     jp2_cdef_destroy (jp2_cod.c) (bsc#1021868)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues :

  - CVE-2016-8654: Heap-based buffer overflow in QMFB code     in JPC codec. (bsc#1012530)

  - CVE-2016-9395: Invalid jasper files could lead to abort     of the library caused by attacker provided image.
    (bsc#1010977)

  - CVE-2016-9398: Invalid jasper files could lead to abort     of the library caused by attacker provided image.
    (bsc#1010979)

  - CVE-2016-9560: Stack-based buffer overflow in     jpc_tsfb_getbands2. (bsc#1011830)

  - CVE-2016-9591: Use-after-free on heap in     jas_matrix_destroy. (bsc#1015993)

This update was imported from the SUSE:SLE-12:Update update project.

This update for jasper fixes the following issues :

  - CVE-2016-8654: Heap-based buffer overflow in QMFB code     in JPC codec. (bsc#1012530)

  - CVE-2016-9395: Invalid jasper files could lead to abort     of the library caused by attacker provided image.
    (bsc#1010977)

  - CVE-2016-9398: Invalid jasper files could lead to abort     of the library caused by attacker provided image.
    (bsc#1010979)

  - CVE-2016-9560: Stack-based buffer overflow in     jpc_tsfb_getbands2. (bsc#1011830)

  - CVE-2016-9591: Use-after-free on heap in     jas_matrix_destroy. (bsc#1015993)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198837	RHEL 6 : jasper (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198829	RHEL 7 : jasper (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198805	RHEL 5 : jasper (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195467	RHEL 7 : jasper (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195364	RHEL 5 : jasper (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
195350	RHEL 6 : jasper (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
146125	Fedora 32 : jasper (2021-0a6290f865)	Nessus	Fedora Local Security Checks	high
145784	Fedora 33 : jasper (2021-2b151590d9)	Nessus	Fedora Local Security Checks	high
143883	SUSE SLED15 / SLES15 Security Update : jasper (SUSE-SU-2020:2689-1)	Nessus	SuSE Local Security Checks	high
143645	SUSE SLES12 Security Update : jasper (SUSE-SU-2020:2690-1)	Nessus	SuSE Local Security Checks	high
141151	openSUSE Security Update : jasper (openSUSE-2020-1517)	Nessus	SuSE Local Security Checks	high
141070	openSUSE Security Update : jasper (openSUSE-2020-1523)	Nessus	SuSE Local Security Checks	high
139830	FreeBSD : jasper -- multiple vulnerabilities (6842ac7e-d250-11ea-b9b7-08002728f74c)	Nessus	FreeBSD Local Security Checks	high
134477	EulerOS Virtualization for ARM 64 3.0.2.0 : jasper (EulerOS-SA-2020-1188)	Nessus	Huawei Local Security Checks	high
132133	EulerOS 2.0 SP3 : jasper (EulerOS-SA-2019-2598)	Nessus	Huawei Local Security Checks	high
131804	EulerOS 2.0 SP5 : jasper (EulerOS-SA-2019-2530)	Nessus	Huawei Local Security Checks	high
131643	EulerOS 2.0 SP2 : jasper (EulerOS-SA-2019-2490)	Nessus	Huawei Local Security Checks	high
99232	SUSE SLES11 Security Update : jasper (SUSE-SU-2017:0946-1)	Nessus	SuSE Local Security Checks	high
96400	openSUSE Security Update : jasper (openSUSE-2017-70)	Nessus	SuSE Local Security Checks	high
96387	SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2017:0084-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2016-9398

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high