Detections
Analytics

FreeBSD : jasper -- multiple vulnerabilities (3a469cbc-7a66-11eb-bd3f-08002728f74c)

high Nessus Plugin ID 147098

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

JasPer Releases :

- Fix memory-related bugs in the JPEG-2000 codec resulting from attempting to decode invalid code streams. (#264, #265)

This fix is associated with CVE-2021-26926 and CVE-2021-26927.

- Fix wrong return value under some compilers (#260)

- Fix CVE-2021-3272 heap buffer overflow in jp2_decode (#259)

Solution

Update the affected package.

See Also

https://github.com/jasper-software/jasper/releases

http://www.nessus.org/u?13bbe111

Plugin Details

Severity: High

ID: 147098

File Name: freebsd_pkg_3a469cbc7a6611ebbd3f08002728f74c.nasl

Version: 1.3

Type: local

Published: 3/4/2021

Updated: 1/16/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.0

CVSS v2

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS Score Source: CVE-2021-26926

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.4

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:jasper, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/3/2021

Vulnerability Publication Date: 2/7/2021

Reference Information

CVE: CVE-2021-26926, CVE-2021-26927, CVE-2021-3272