The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jasper: heap-based buffer over-read of size 8 in jas_image_depalettize in libjasper/base/jas_image.c     (CVE-2018-19541)

  - jasper: heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2018-19543)

  - The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers     to have unspecified impact via a crafted file, which triggers a memory allocation failure. (CVE-2016-8886)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

インストールされているjasperパッケージのバージョンによると、リモートホストへのEulerOSのインストールは、次の脆弱性の影響を受けます。- 1.900.17より前のJasPerのjpc_math.cにあるjpc_floorlog2関数により、詳細不明なベクトルを介してリモートの攻撃者がサービス拒否（アサーションエラー）を引き起こす可能性があります。（CVE-2016-9398）- JasPer 2.0.14ではlibjasper/jpc/jpc_math.cの関数jpc_firstoneにある到達可能なアサーションを介したサービス拒否が許可されます。（CVE-2018-9055）- JasPer 2.0.14で問題が発見されました。libjasper/base/jas_image.cの関数jas_image_readcmptにアクセス違反があり、サービス拒否につながります。（CVE-2018-19539）- JasPer 2.0.14で問題が発見されました。libjasper/base/jas_icc.cの関数jas_icctxtdesc_inputにサイズ1のヒープベースバッファオーバーフローがあります。（CVE-2018-19540）- JasPer 2.0.14で問題が発見されました。libjasper/base/jas_image.cの関数jas_image_depalettizeにサイズ8のヒープベースのバッファオーバーリードがあります。（CVE-2018-19541）- JasPer 2.0.14で問題が見つかりました。libjasper/jp2/jp2_dec.cの関数jp2_decodeにNULLポインターの逆参照があり、サービス拒否につながります。（CVE-2018-19542）- JasPer 2.0.12には、base/jas_string.cの関数jas_strdup()でトリガーされる多くのメモリリークがあり、リモートのサービス拒否攻撃につながります。（CVE-2017-13748）- JasPer 2.0.12のjpc/jpc_dec.cにある関数calcstepsizes()に到達可能なアサーションアボートがあり、リモートのサービス拒否攻撃につながります。（CVE-2017-13751）- JasPer 2.0.10のjpc_t2dec.cにあるjpc_dec_decodepkt関数のヒープベースバッファオーバーフローにより、リモートの攻撃者が細工されたイメージを介して詳細不明な影響を与える可能性があります。（CVE-2017-6852）注：Tenable Network Securityは、前述の記述ブロックをEulerOSセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

リモートホストは、GLSA-201908-03（JasPer：複数の脆弱性）で説明されている脆弱性による影響を受けます。複数の脆弱性がJasPerで発見されています。詳細については、以下に記載されているCVE識別番号を参照してください。影響：詳細については、記載されているCVE識別番号を参照してください。回避策：現時点では、既知の回避策はありません。

According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The jp2_colr_destroy function in     libjasper/jp2/jp2_cod.c in JasPer before 1.900.10     allows remote attackers to cause a denial of service     (NULL pointer dereference).(CVE-2016-8887)

  - The jp2_cdef_destroy function in jp2_cod.c in JasPer     before 2.0.13 allows remote attackers to cause a denial     of service (NULL pointer dereference) via a crafted     image.(CVE-2017-6850)

  - The jp2_colr_destroy function in jp2_cod.c in JasPer     before 1.900.13 allows remote attackers to cause a     denial of service (NULL pointer dereference) by     leveraging incorrect cleanup of JP2 box data on error.
    NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-8887.(CVE-2016-10250)

  - Heap-based buffer overflow in the jpc_dec_decodepkt     function in jpc_t2dec.c in JasPer 2.0.10 allows remote     attackers to have unspecified impact via a crafted     image.(CVE-2017-6852)

  - Race condition in the jas_stream_tmpfile function in     libjasper/base/jas_stream.c in JasPer 1.900.1 allows     local users to cause a denial of service (program exit)     by creating the appropriate tmp.XXXXXXXXXX temporary     file, which causes Jasper to exit. NOTE: this was     originally reported as a symlink issue, but this was     incorrect. NOTE: some vendors dispute the severity of     this issue, but it satisfies CVE's requirements for     inclusion.(CVE-2008-3521)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jasper: heap-based buffer over-read of size 8 in jas_image_depalettize in libjasper/base/jas_image.c     (CVE-2018-19541)

  - jasper: heap-based buffer over-read in jp2_decode() in jp2_dec.c (CVE-2018-19543)

  - The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers     to have unspecified impact via a crafted file, which triggers a memory allocation failure. (CVE-2016-8886)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The jpc_floorlog2 function in jpc_math.c in JasPer     before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified     vectors.(CVE-2016-9398)

  - JasPer 2.0.14 allows denial of service via a reachable     assertion in the function jpc_firstone in     libjasper/jpc/jpc_math.c.(CVE-2018-9055)

  - An issue was discovered in JasPer 2.0.14. There is an     access violation in the function jas_image_readcmpt in     libjasper/base/jas_image.c, leading to a denial of     service.(CVE-2018-19539)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer overflow of size 1 in the function     jas_icctxtdesc_input in     libjasper/base/jas_icc.c.(CVE-2018-19540)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer over-read of size 8 in the function     jas_image_depalettize in     libjasper/base/jas_image.c.(CVE-2018-19541)

  - An issue was discovered in JasPer 2.0.14. There is a     NULL pointer dereference in the function jp2_decode in     libjasper/jp2/jp2_dec.c, leading to a denial of     service.(CVE-2018-19542)

  - There are lots of memory leaks in JasPer 2.0.12,     triggered in the function jas_strdup() in     base/jas_string.c, that will lead to a remote denial of     service attack.(CVE-2017-13748)

  - There is a reachable assertion abort in the function     calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that     will lead to a remote denial of service     attack.(CVE-2017-13751)

  - Heap-based buffer overflow in the jpc_dec_decodepkt     function in jpc_t2dec.c in JasPer 2.0.10 allows remote     attackers to have unspecified impact via a crafted     image.(CVE-2017-6852)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the jasper package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer overflow of size 1 in the function     jas_icctxtdesc_input in     libjasper/base/jas_icc.c.(CVE-2018-19540)

  - An issue was discovered in JasPer 2.0.14. There is a     heap-based buffer over-read of size 8 in the function     jas_image_depalettize in     libjasper/base/jas_image.c.(CVE-2018-19541)

  - An issue was discovered in JasPer 2.0.14. There is a     NULL pointer dereference in the function jp2_decode in     libjasper/jp2/jp2_dec.c, leading to a denial of     service.(CVE-2018-19542)

  - An issue was discovered in JasPer 2.0.14. There is an     access violation in the function jas_image_readcmpt in     libjasper/base/jas_image.c, leading to a denial of     service.(CVE-2018-19539)

  - Heap-based buffer overflow in the jpc_dec_decodepkt     function in jpc_t2dec.c in JasPer 2.0.10 allows remote     attackers to have unspecified impact via a crafted     image.(CVE-2017-6852)

  - JasPer 2.0.14 allows denial of service via a reachable     assertion in the function jpc_firstone in     libjasper/jpc/jpc_math.c.(CVE-2018-9055)

  - The jpc_floorlog2 function in jpc_math.c in JasPer     before 1.900.17 allows remote attackers to cause a     denial of service (assertion failure) via unspecified     vectors.(CVE-2016-9398)

  - There are lots of memory leaks in JasPer 2.0.12,     triggered in the function jas_strdup() in     base/jas_string.c, that will lead to a remote denial of     service attack.(CVE-2017-13748)

  - There is a reachable assertion abort in the function     calcstepsizes() in jpc/jpc_dec.c in JasPer 2.0.12 that     will lead to a remote denial of service     attack.(CVE-2017-13751)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201908-03 (JasPer: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in JasPer. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the versions of the jasper package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Runtime libraries for jasper. Security Fix(es):Race     condition in the jas_stream_tmpfile function in     libjasper/base/jas_stream.c in JasPer 1.900.1 allows     local users to cause a denial of service (program exit)     by creating the appropriate tmp.XXXXXXXXXX temporary     file, which causes Jasper to exit. NOTE: this was     originally reported as a symlink issue, but this was     incorrect. NOTE: some vendors dispute the severity of     this issue, but it satisfies CVE's requirements for     inclusion.(CVE-2008-3521)Heap-based buffer overflow in     the jpc_dec_decodepkt function in jpc_t2dec.c in JasPer     2.0.10 allows remote attackers to have unspecified     impact via a crafted image.(CVE-2017-6852)The     jp2_colr_destroy function in jp2_cod.c in JasPer before     1.900.13 allows remote attackers to cause a denial of     service (NULL pointer dereference) by leveraging     incorrect cleanup of JP2 box data on error. NOTE: this     vulnerability exists because of an incomplete fix for     CVE-2016-8887.(CVE-2016-10250)The jp2_cdef_destroy     function in jp2_cod.c in JasPer before 2.0.13 allows     remote attackers to cause a denial of service (NULL     pointer dereference) via a crafted     image.(CVE-2017-6850)The jp2_colr_destroy function in     libjasper/jp2/jp2_cod.c in JasPer before 1.900.10     allows remote attackers to cause a denial of service     (NULL pointer dereference).(CVE-2016-8887)The     jpc_floorlog2 function in jpc_math.c in JasPer before     1.900.17 allows remote attackers to cause a denial of     service (assertion failure) via unspecified     vectors.(CVE-2016-9398)JasPer 2.0.12 is vulnerable to a     NULL pointer exception in the function jp2_encode which     failed to check to see if the image contained at least     one component resulting in a     denial-of-service.(CVE-2017-1000050)The jpc_pi_nextrpcl     function in jpc_t2cod.c in JasPer before 1.900.17     allows remote attackers to cause a denial of service     (assertion failure) via a crafted     file.(CVE-2016-9393)The bmp_getdata function in     libjasper/bmp/bmp_dec.c in JasPer 1.900.5 allows remote     attackers to cause a denial of service (NULL pointer     dereference) by calling the imginfo command with a     crafted BMP image. NOTE: this vulnerability exists     because of an incomplete fix for     CVE-2016-8690.(CVE-2016-8884)There is a reachable     assertion abort in the function jpc_dequantize() in     jpc/jpc_dec.c in JasPer 2.0.12 that will lead to a     remote denial of service attack.(CVE-2017-13752)The     jpc_dequantize function in jpc_dec.c in JasPer 1.900.13     allows remote attackers to cause a denial of service     (assertion failure) via unspecified     vectors.(CVE-2016-9397)There is a reachable assertion     abort in the function jpc_floorlog2() in jpc/jpc_math.c     in JasPer 2.0.12 that will lead to a remote denial of     service attack.(CVE-2017-13747)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jasper: Out of bounds heap read in jpc_dec_decodepkt (CVE-2017-6852)

  - The jas_malloc function in libjasper/base/jas_malloc.c in JasPer before 1.900.11 allows remote attackers     to have unspecified impact via a crafted file, which triggers a memory allocation failure. (CVE-2016-8886)

  - The jas_seq2d_create function in jas_seq.c in JasPer before 1.900.25 allows remote attackers to cause a     denial of service (assertion failure) via a crafted file. (CVE-2016-9395)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

根据安装的 jasper 程序包版本，远程主机上的 EulerOS 安装会受到下列漏洞影响：- 在 JasPer 1.900.17 之前的版本中，jpc_math.c 中的 jpc_floorlog2 函数可让远程攻击者通过不明向量造成拒绝服务（断言失败）。(CVE-2016-9398) - JasPer 2.0.14 允许在 libjasper/jpc/jpc_math.c 的 jpc_firstone 函数中，通过可访问的断言造成拒绝服务。(CVE-2018-9055) - 在 JasPer 2.0.14 中发现一个问题。在 libjasper/base/jas_image.c 的 jas_image_readcmpt 函数中发生访问违规，进而导致拒绝服务。(CVE-2018-19539) - 在 JasPer 2.0.14 中发现一个问题。在 libjasper/base/jas_icc.c 的 jas_icctxtdesc_input 函数中发生大小为 1 的基于堆的缓冲区溢出。(CVE-2018-19540) - 在 JasPer 2.0.14 中发现一个问题。在 libjasper/base/jas_image.c 的 jas_image_depalettize 函数中，存在一个大小为 8 的基于堆的缓冲区过度读取。(CVE-2018-19541) - 在 JasPer 2.0.14 中发现一个问题。在 libjasper/jp2/jp2_dec.c 的 jp2_decode 函数中发生空指针取消引用，进而导致拒绝服务。(CVE-2018-19542) - JasPer 2.0.12 中有很多内存泄露问题（在 base/jas_string.c 的 jas_strdup() 函数中触发），这将会导致远程拒绝服务攻击。(CVE-2017-13748) - 在 JasPer 2.0.12 中，jpc/jpc_dec.c 的 calcstepsizes() 函数中发生可访问的断言终止，这将会导致远程拒绝服务攻击。(CVE-2017-13751) - 在 JasPer 2.0.10 中，jpc_t2dec.c 之 jpc_dec_decodepkt 函数中的基于堆的缓冲区溢出，可让远程攻击者通过特制的图像造成不明影响。(CVE-2017-6852) 请注意，Tenable Network Security 已直接从 EulerOS 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

远程主机受到 GLSA-201908-03 中所述漏洞的影响（JasPer：多个漏洞）在 JasPer 中发现多个漏洞。请检查下面供参考的 CVE 标识符以了解详细信息。影响：如需详细信息，请查看供参考的 CVE 标识符。解决方法：目前无任何已知的解决方法。

根據安裝的 jasper 套件版本，遠端主機上的 EulerOS 安裝會受到下列弱點影響：- 在 JasPer 1.900.17 之前的版本中，jpc_math.c 中的 jpc_floorlog2 函式可讓遠端攻擊者透過不明向量造成拒絕服務 (宣告失敗)。(CVE-2016-9398) - JasPer 2.0.14 允許在 libjasper/jpc/jpc_math.c 的 jpc_firstone 函式中，透過可連線的宣告造成拒絕服務。(CVE-2018-9055) - 在 JasPer 2.0.14 中發現一個問題。在 libjasper/base/jas_image.c 的 jas_image_readcmpt 函式中發生存取違規，進而導致拒絕服務。(CVE-2018-19539) - 在 JasPer 2.0.14 中發現一個問題。在 libjasper/base/jas_icc.c 的 jas_icctxtdesc_input 函式中發生大小為 1 的堆積型緩衝區溢位。(CVE-2018-19540) - 在 JasPer 2.0.14 中發現一個問題。在 libjasper/base/jas_image.c 的 jas_image_depalettize 函式中，存在一個大小為 8 的堆積型緩衝區過度讀取。(CVE-2018-19541) - 在 JasPer 2.0.14 中發現一個問題。在 libjasper/jp2/jp2_dec.c 的 jp2_decode 函式中發生 NULL 指標解除參照，進而導致拒絕服務。(CVE-2018-19542) – JasPer 2.0.12 中有很多記憶體洩漏問題 (在 base/jas_string.c 的 jas_strdup() 函式中觸發)，這將會導致遠端拒絕服務攻擊。(CVE-2017-13748) – 在 JasPer 2.0.12 中，jpc/jpc_dec.c 的 calcstepsizes() 函式中發生可連線的宣告中止，這將會導致遠端拒絕服務攻擊。(CVE-2017-13751) – 在 JasPer 2.0.10 中，jpc_t2dec.c 之 jpc_dec_decodepkt 函式中的堆積型緩衝區溢位，可讓遠端攻擊者透過特製的影像造成不明影響。(CVE-2017-6852) 請注意，Tenable Network Security 已直接從 EulerOS 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端主機受到 GLSA-201908-03 中所述的弱點影響 (JasPer：多個弱點) 在 JasPer 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。影響：如需詳細資料，請檢閱提及的 CVE 識別碼。因應措施：目前尚無已知的因應措施。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
198837	RHEL 6 : jasper (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
131643	EulerOS 2.0 SP2：jasper（EulerOS-SA-2019-2490）	Nessus	Huawei Local Security Checks	2019/12/4	2024/4/8	high
127561	GLSA-201908-03：JasPer：複数の脆弱性	Nessus	Gentoo Local Security Checks	2019/8/12	2024/5/7	high
130699	EulerOS 2.0 SP5 : jasper (EulerOS-SA-2019-2237)	Nessus	Huawei Local Security Checks	2019/11/8	2024/4/15	high
198829	RHEL 7 : jasper (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
131643	EulerOS 2.0 SP2 : jasper (EulerOS-SA-2019-2490)	Nessus	Huawei Local Security Checks	2019/12/4	2024/4/8	high
132133	EulerOS 2.0 SP3 : jasper (EulerOS-SA-2019-2598)	Nessus	Huawei Local Security Checks	2019/12/18	2024/4/4	high
127561	GLSA-201908-03 : JasPer: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2019/8/12	2024/5/7	high
134477	EulerOS Virtualization for ARM 64 3.0.2.0 : jasper (EulerOS-SA-2020-1188)	Nessus	Huawei Local Security Checks	2020/3/13	2024/3/22	high
198805	RHEL 5 : jasper (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
131643	EulerOS 2.0 SP2：jasper (EulerOS-SA-2019-2490)	Nessus	Huawei Local Security Checks	2019/12/4	2024/4/8	high
127561	GLSA-201908-03：JasPer：多个漏洞	Nessus	Gentoo Local Security Checks	2019/8/12	2024/5/7	high
131643	EulerOS 2.0 SP2：jasper (EulerOS-SA-2019-2490)	Nessus	Huawei Local Security Checks	2019/12/4	2024/4/8	high
127561	GLSA-201908-03：JasPer：多個弱點	Nessus	Gentoo Local Security Checks	2019/8/12	2024/5/7	high

検出

プラグインの検索

high

high

high

high

high

high

high

high

high

high

high

high

high

high