An issue was discovered in JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14, 1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21, 1.900.22, 1.900.23, 1.900.24, 1.900.25, 1.900.26, 1.900.27, 1.900.28, 1.900.29, 1.900.30, 1.900.31, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16. There is a heap-based buffer over-read of size 8 in the function jas_image_depalettize in libjasper/base/jas_image.c.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jasper: heap-based buffer over-read of size 8 in jas_image_depalettize in libjasper/base/jas_image.c     (CVE-2018-19541)

  - jasper: heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2018-19543)

  - Integer overflow in libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial     of service (crash) via a crafted file. (CVE-2017-5499)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jasper: heap-based buffer over-read of size 8 in jas_image_depalettize in libjasper/base/jas_image.c     (CVE-2018-19541)

  - jasper: heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2018-19543)

  - The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers     to have unspecified impact via a crafted file, which triggers a memory allocation failure. (CVE-2016-8886)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jasper: heap-based buffer over-read of size 8 in jas_image_depalettize in libjasper/base/jas_image.c     (CVE-2018-19541)

  - jasper: heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2018-19543)

  - The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers     to have unspecified impact via a crafted file, which triggers a memory allocation failure. (CVE-2016-8886)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the jasker packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in JasPer 2.0.14. There is an     access violation in the function jas_image_readcmpt in     libjasper/base/jas_image.c, leading to a denial of     service.(CVE-2018-19539)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer overflow of size 1 in the function     jas_icctxtdesc_input in     libjasper/base/jas_icc.c.(CVE-2018-19540)

  - An issue was discovered in JasPer 2.0.14. There is a     NULL pointer dereference in the function jp2_decode in     libjasper/jp2/jp2_dec.c, leading to a denial of     service.(CVE-2018-19542)

  - An issue has been found in JasPer 2.0.14. There is a     memory leak in jas_malloc.c when called from     jpc_unk_getparms in jpc_cs.c.(CVE-2018-19139)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer over-read of size 8 in the function     jas_image_depalettize in     libjasper/base/jas_image.c.(CVE-2018-19541)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

JasPer NEWS :

- Fix CVE-2018-9154

- Fix CVE-2018-19541

- Fix CVE-2016-9399, CVE-2017-13751

- Fix CVE-2018-19540

- Fix CVE-2018-9055

- Fix CVE-2017-13748

- Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505

- Fix CVE-2018-9252

- Fix CVE-2018-19139

- Fix CVE-2018-19543, CVE-2017-9782

- Fix CVE-2018-20570

- Fix CVE-2018-20622

- Fix CVE-2016-9398

- Fix CVE-2017-14132

- Fix CVE-2017-5499

- Fix CVE-2018-18873

- Fix CVE-2017-13750

According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer overflow of size 1 in the function     jas_icctxtdesc_input in     libjasper/base/jas_icc.c.(CVE-2018-19540)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer over-read of size 8 in the function     jas_image_depalettize in     libjasper/base/jas_image.c.(CVE-2018-19541)

  - An issue was discovered in JasPer 2.0.14. There is a     NULL pointer dereference in the function jp2_decode in     libjasper/jp2/jp2_dec.c, leading to a denial of     service.(CVE-2018-19542)

  - An issue was discovered in JasPer 2.0.14. There is an     access violation in the function jas_image_readcmpt in     libjasper/base/jas_image.c, leading to a denial of     service.(CVE-2018-19539)

  - Heap-based buffer overflow in the jpc_dec_decodepkt     function in jpc_t2dec.c in JasPer 2.0.10 allows remote     attackers to have unspecified impact via a crafted     image.(CVE-2017-6852)

  - JasPer 2.0.14 allows denial of service via a reachable     assertion in the function jpc_firstone in     libjasper/jpc/jpc_math.c.(CVE-2018-9055)

  - The jpc_floorlog2 function in jpc_math.c in JasPer     before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified     vectors.(CVE-2016-9398)

  - There are lots of memory leaks in JasPer 2.0.12,     triggered in the function jas_strdup() in     base/jas_string.c, that will lead to a remote denial of     service attack.(CVE-2017-13748)

  - There is a reachable assertion abort in the function     calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that     will lead to a remote denial of service     attack.(CVE-2017-13751)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The jpc_floorlog2 function in jpc_math.c in JasPer     before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified     vectors.(CVE-2016-9398)

  - JasPer 2.0.14 allows denial of service via a reachable     assertion in the function jpc_firstone in     libjasper/jpc/jpc_math.c.(CVE-2018-9055)

  - An issue was discovered in JasPer 2.0.14. There is an     access violation in the function jas_image_readcmpt in     libjasper/base/jas_image.c, leading to a denial of     service.(CVE-2018-19539)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer overflow of size 1 in the function     jas_icctxtdesc_input in     libjasper/base/jas_icc.c.(CVE-2018-19540)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer over-read of size 8 in the function     jas_image_depalettize in     libjasper/base/jas_image.c.(CVE-2018-19541)

  - An issue was discovered in JasPer 2.0.14. There is a     NULL pointer dereference in the function jp2_decode in     libjasper/jp2/jp2_dec.c, leading to a denial of     service.(CVE-2018-19542)

  - There are lots of memory leaks in JasPer 2.0.12,     triggered in the function jas_strdup() in     base/jas_string.c, that will lead to a remote denial of     service attack.(CVE-2017-13748)

  - There is a reachable assertion abort in the function     calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that     will lead to a remote denial of service     attack.(CVE-2017-13751)

  - Heap-based buffer overflow in the jpc_dec_decodepkt     function in jpc_t2dec.c in JasPer 2.0.10 allows remote     attackers to have unspecified impact via a crafted     image.(CVE-2017-6852)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the jasper package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - JasPer 2.0.12 is vulnerable to a NULL pointer exception     in the function jp2_encode which failed to check to see     if the image contained at least one component resulting     in a denial-of-service.(CVE-2017-1000050)

  - The JPC_NOMINALGAIN function in jpc/jpc_t1cod.c in     JasPer through 2.0.12 allows remote attackers to cause     a denial of service (JPC_COX_RFT assertion failure) via     unspecified vectors.(CVE-2016-9396)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer over-read of size 8 in the function     jas_image_depalettize in     libjasper/base/jas_image.c.(CVE-2018-19541)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer overflow of size 1 in the function     jas_icctxtdesc_input in     libjasper/base/jas_icc.c.(CVE-2018-19540)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues :

Security issues fixed :

  - CVE-2018-19540: Fixed a heap based overflow in     jas_icctxtdesc_input (bsc#1117508).

  - CVE-2018-19541: Fix heap based overread in     jas_image_depalettize (bsc#1117507).

This update was imported from the SUSE:SLE-15:Update update project.

This update for jasper fixes the following issues :

Security issues fixed :

CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input (bsc#1117508).

CVE-2018-19541: Fix heap based overread in jas_image_depalettize (bsc#1117507).

CVE-2018-19542: Fixed a denial of service in jp2_decode (bsc#1117505).

CVE-2018-19539: Fixed a denial of service in jas_image_readcmpt (bsc#1117511).

CVE-2016-9396: Fixed a denial of service in jpc_cox_getcompparms (bsc#1010783).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for jasper fixes the following issues :

Security issues fixed :

CVE-2018-19540: Fixed a heap based overflow in jas_icctxtdesc_input (bsc#1117508).

CVE-2018-19541: Fix heap based overread in jas_image_depalettize (bsc#1117507).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198855	RHEL 8 : jasper (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198837	RHEL 6 : jasper (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198829	RHEL 7 : jasper (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
144718	EulerOS Virtualization for ARM 64 3.0.2.0 : jasker (EulerOS-SA-2021-1044)	Nessus	Huawei Local Security Checks	high
139830	FreeBSD : jasper -- multiple vulnerabilities (6842ac7e-d250-11ea-b9b7-08002728f74c)	Nessus	FreeBSD Local Security Checks	high
132133	EulerOS 2.0 SP3 : jasper (EulerOS-SA-2019-2598)	Nessus	Huawei Local Security Checks	high
131643	EulerOS 2.0 SP2 : jasper (EulerOS-SA-2019-2490)	Nessus	Huawei Local Security Checks	high
131497	EulerOS Virtualization for ARM 64 3.0.3.0 : jasper (EulerOS-SA-2019-2332)	Nessus	Huawei Local Security Checks	high
129710	openSUSE Security Update : jasper (openSUSE-2019-2282)	Nessus	SuSE Local Security Checks	high
129707	openSUSE Security Update : jasper (openSUSE-2019-2279)	Nessus	SuSE Local Security Checks	high
129553	SUSE SLED12 / SLES12 Security Update : jasper (SUSE-SU-2019:2513-1)	Nessus	SuSE Local Security Checks	high
129552	SUSE SLED15 / SLES15 Security Update : jasper (SUSE-SU-2019:2512-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-19541

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high